SmartHawk

6.0

高危

56 个模型检测该样本为恶意！

重新分析

下载样本

74fa3e13df2e15d0d486699eba917aa51a47b6e4466f5b2c88e06a9980a79c60

d9546c897b143621ec8b47a075ec99a4.exe

分析耗时

77s

最近分析

文件大小

286.5KB

静态报毒动态报毒 ACGFB AIDETECTVM ATTRIBUTE CKGENERIC CLOUD CRYPTERX ELDORADO EMOTET GENCIRC GENERICKD GENETIC HFLS HIGH CONFIDENCE HIGHCONFIDENCE HRMCNR KRYPTIK MALWARE1 POSSIBLETHREAT QVM10 R06BC0DHB20 R347335 RQ0@A0AU@IWI SCORE SKEEYAH SUSGEN TRICKBOT TRICKSTER UNCLASSIFIEDMALWARE@0 UNSAFE ZEXAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Alibaba	Trojan:Win32/Emotet.653508c3	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:CrypterX-gen [Trj]	20200827	18.4.3895.0
Kingsoft		20200827	2013.8.14.323
McAfee	Emotet-FQS!D9546C897B14	20200826	6.0.6.653
Tencent	Malware.Win32.Gencirc.10cde801	20200827	1.0.0.1
CrowdStrike		20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619948434.477307 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (4 个事件)

Time & API	Arguments	Status	Return
1619948418.555307 CryptGenKey	crypto_handle: 0x02b60e98 algorithm_identifier: 0x0000660e () provider_handle: 0x006b2c90 flags: 1 key: fÿëtåÌfq9g× ü	success	1
1619948434.493307 CryptExportKey	crypto_handle: 0x02b60e98 crypto_export_handle: 0x005f7e88 buffer: f¤®¡ÿÓYA PTZ¸\[tÀýðÞx5Iÿ9Ù^ÑJ=Üÿ3µ0S¸Gxpìz~Ì# É«Fðø/Ññ_b®õZ røÐøbD+ÀÛþAi·Ê< blob_type: 1 flags: 64	success	1
1619948443.118307 CryptExportKey	crypto_handle: 0x02b60e98 crypto_export_handle: 0x005f7e88 buffer: f¤q¿Ùöó$OlÀ"à;ÚPtÀvzÙA®\|xVN0p·T !LµÏÐ-Ð!K¥}X$ö>·³Ü%Í&.EzY4QõÖ[©ÊDá"Ì ³îåh blob_type: 1 flags: 64	success	1
1619948475.915307 CryptExportKey	crypto_handle: 0x02b60e98 crypto_export_handle: 0x005f7e88 buffer: f¤d§[Ã£¶lV¶sîç¼¹GØ7¼ÕXÍ@¦îÊ/£{ÜSÖÒ^óö>Åó~Î±`âÅýÊ-ÚA1Ez±qÎFAcØù¾÷3o,?3Ö7P)]<·À blob_type: 1 flags: 64	success	1

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619948418.024307 NtProtectVirtualMemory	process_identifier: 2224 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 36864 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x005e6000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619948435.009307 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

d9546c897b143621ec8b47a075ec99a4.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619948434.680307 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (4 个事件)

host	139.99.157.213
host	172.217.24.14
host	188.166.25.84
host	202.5.47.71

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619948437.587307 RegSetValueExA	key_handle: 0x000003a8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619948437.587307 RegSetValueExA	key_handle: 0x000003a8 value: `·?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619948437.587307 RegSetValueExA	key_handle: 0x000003a8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619948437.602307 RegSetValueExW	key_handle: 0x000003a8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619948437.602307 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619948437.602307 RegSetValueExA	key_handle: 0x000003c0 value: `·?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619948437.602307 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619948437.618307 RegSetValueExW	key_handle: 0x000003a4 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.34333241
FireEye	Trojan.GenericKD.34333241
CAT-QuickHeal	Trojan.CKGENERIC
Qihoo-360	Generic/HEUR/QVM10.2.2723.Malware.Gen
ALYac	Trojan.GenericKD.34333241
Cylance	Unsafe
Zillya	Backdoor.Emotet.Win32.927
Sangfor	Malware
K7AntiVirus	Trojan ( 005661dc1 )
Alibaba	Trojan:Win32/Emotet.653508c3
K7GW	Trojan ( 005661dc1 )
Arcabit	Trojan.Generic.D20BE239
TrendMicro	TROJ_GEN.R06BC0DHB20
Cyren	W32/Trickbot.DP.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:CrypterX-gen [Trj]
Kaspersky	HEUR:Backdoor.Win32.Emotet.vho
BitDefender	Trojan.GenericKD.34333241
NANO-Antivirus	Trojan.Win32.Emotet.hrmcnr
Paloalto	generic.ml
AegisLab	Trojan.Win32.Emotet.L!c
Rising	Trojan.Kryptik!1.CA53 (CLOUD)
Ad-Aware	Trojan.GenericKD.34333241
TACHYON	Banker/W32.Trickster.293376
Emsisoft	Trojan.Emotet (A)
Comodo	.UnclassifiedMalware@0
F-Secure	Trojan.TR/AD.Emotet.acgfb
DrWeb	Trojan.Emotet.999
VIPRE	Trojan.Win32.Generic!BT
Invincea	heuristic
Sophos	Troj/Emotet-CKT
Jiangmin	Backdoor.Emotet.qc
Webroot	W32.Trojan.Gen
Avira	TR/AD.Emotet.acgfb
Antiy-AVL	Trojan/Win32.Kryptik
Microsoft	Trojan:Win32/Skeeyah.B!rfn
ViRobot	Trojan.Win32.Z.Emotet.293376.D
ZoneAlarm	HEUR:Backdoor.Win32.Emotet.vho
GData	Trojan.GenericKD.34333241
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Emotet.R347335
McAfee	Emotet-FQS!D9546C897B14
VBA32	Trojan.Emotet
Malwarebytes	Trojan.MalPack.TRE
ESET-NOD32	a variant of Win32/Kryptik.HFLS
TrendMicro-HouseCall	TROJ_GEN.R06BC0DHB20
Tencent	Malware.Win32.Gencirc.10cde801

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	139.99.157.213:8080
dead_host	202.5.47.71:80
dead_host	192.168.56.101:49176

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-07 18:35:42

Imports

Library KERNEL32.dll:

• 0x42a08c GetCommandLineA

• 0x42a090 GetStartupInfoA

• 0x42a094 HeapAlloc

• 0x42a098 HeapFree

• 0x42a09c Sleep

• 0x42a0a0 ExitProcess

• 0x42a0a4 VirtualAlloc

• 0x42a0a8 HeapReAlloc

• 0x42a0ac HeapSize

• 0x42a0b0 TerminateProcess

• 0x42a0b4 UnhandledExceptionFilter

• 0x42a0b8 SetUnhandledExceptionFilter

• 0x42a0bc IsDebuggerPresent

• 0x42a0c0 GetACP

• 0x42a0c4 IsValidCodePage

• 0x42a0c8 LCMapStringW

• 0x42a0cc GetStdHandle

• 0x42a0d0 FreeEnvironmentStringsA

• 0x42a0d4 GetEnvironmentStrings

• 0x42a0d8 FreeEnvironmentStringsW

• 0x42a0dc GetEnvironmentStringsW

• 0x42a0e0 SetHandleCount

• 0x42a0e4 RaiseException

• 0x42a0e8 HeapCreate

• 0x42a0ec VirtualFree

• 0x42a0f0 QueryPerformanceCounter

• 0x42a0f4 GetTickCount

• 0x42a0f8 GetSystemTimeAsFileTime

• 0x42a0fc InitializeCriticalSectionAndSpinCount

• 0x42a100 LCMapStringA

• 0x42a104 GetStringTypeA

• 0x42a108 GetStringTypeW

• 0x42a10c GetUserDefaultLCID

• 0x42a110 EnumSystemLocalesA

• 0x42a114 IsValidLocale

• 0x42a118 GetLocaleInfoW

• 0x42a11c GetConsoleCP

• 0x42a120 GetConsoleMode

• 0x42a124 SetStdHandle

• 0x42a128 WriteConsoleA

• 0x42a12c GetConsoleOutputCP

• 0x42a130 WriteConsoleW

• 0x42a134 RtlUnwind

• 0x42a138 SetErrorMode

• 0x42a13c GetModuleHandleW

• 0x42a140 GetOEMCP

• 0x42a144 GetCPInfo

• 0x42a148 CreateFileA

• 0x42a14c GetCurrentProcess

• 0x42a150 FlushFileBuffers

• 0x42a154 SetFilePointer

• 0x42a158 WriteFile

• 0x42a15c ReadFile

• 0x42a160 InterlockedIncrement

• 0x42a164 TlsFree

• 0x42a168 DeleteCriticalSection

• 0x42a16c LocalReAlloc

• 0x42a170 TlsSetValue

• 0x42a174 TlsAlloc

• 0x42a178 InitializeCriticalSection

• 0x42a17c GlobalHandle

• 0x42a180 GlobalReAlloc

• 0x42a184 EnterCriticalSection

• 0x42a188 TlsGetValue

• 0x42a18c LeaveCriticalSection

• 0x42a190 LocalAlloc

• 0x42a194 GlobalFlags

• 0x42a198 WritePrivateProfileStringA

• 0x42a19c InterlockedDecrement

• 0x42a1a0 GetModuleFileNameW

• 0x42a1a4 FormatMessageA

• 0x42a1a8 LocalFree

• 0x42a1ac MulDiv

• 0x42a1b0 lstrlenA

• 0x42a1b4 GlobalGetAtomNameA

• 0x42a1b8 GlobalFindAtomA

• 0x42a1bc MultiByteToWideChar

• 0x42a1c0 lstrcmpW

• 0x42a1c4 GetVersionExA

• 0x42a1c8 GlobalUnlock

• 0x42a1cc GlobalFree

• 0x42a1d0 FreeResource

• 0x42a1d4 GetCurrentProcessId

• 0x42a1d8 GetLastError

• 0x42a1dc SetLastError

• 0x42a1e0 GlobalAddAtomA

• 0x42a1e4 CloseHandle

• 0x42a1e8 GlobalDeleteAtom

• 0x42a1ec GetCurrentThread

• 0x42a1f0 GetCurrentThreadId

• 0x42a1f4 ConvertDefaultLocale

• 0x42a1f8 EnumResourceLanguagesA

• 0x42a1fc GetModuleFileNameA

• 0x42a200 GetLocaleInfoA

• 0x42a204 LoadLibraryA

• 0x42a208 CompareStringA

• 0x42a20c InterlockedExchange

• 0x42a210 GlobalLock

• 0x42a214 lstrcmpA

• 0x42a218 GlobalAlloc

• 0x42a21c FreeLibrary

• 0x42a220 GetModuleHandleA

• 0x42a224 GetProcAddress

• 0x42a228 GetCurrentDirectoryA

• 0x42a22c WideCharToMultiByte

• 0x42a230 FindResourceA

• 0x42a234 LoadResource

• 0x42a238 LockResource

• 0x42a23c GetFileType

• 0x42a240 SizeofResource

Library USER32.dll:

• 0x42a270 GetSysColorBrush

• 0x42a274 LoadCursorA

• 0x42a278 EndPaint

• 0x42a27c BeginPaint

• 0x42a280 ReleaseDC

• 0x42a284 GetDC

• 0x42a288 ClientToScreen

• 0x42a28c GrayStringA

• 0x42a290 DrawTextExA

• 0x42a294 DrawTextA

• 0x42a298 TabbedTextOutA

• 0x42a29c DestroyMenu

• 0x42a2a0 ShowWindow

• 0x42a2a4 MoveWindow

• 0x42a2a8 SetWindowTextA

• 0x42a2ac IsDialogMessageA

• 0x42a2b0 RegisterWindowMessageA

• 0x42a2b4 SendDlgItemMessageA

• 0x42a2b8 WinHelpA

• 0x42a2bc GetCapture

• 0x42a2c0 GetClassLongA

• 0x42a2c4 GetClassNameA

• 0x42a2c8 SetPropA

• 0x42a2cc GetPropA

• 0x42a2d0 RemovePropA

• 0x42a2d4 SetFocus

• 0x42a2d8 GetWindowTextLengthA

• 0x42a2dc GetTopWindow

• 0x42a2e0 UnhookWindowsHookEx

• 0x42a2e4 GetMessageTime

• 0x42a2e8 GetMessagePos

• 0x42a2ec MapWindowPoints

• 0x42a2f0 SetMenu

• 0x42a2f4 SetForegroundWindow

• 0x42a2f8 UpdateWindow

• 0x42a2fc GetSubMenu

• 0x42a300 GetMenuItemID

• 0x42a304 GetMenuItemCount

• 0x42a308 CreateWindowExA

• 0x42a30c GetClassInfoExA

• 0x42a310 GetClassInfoA

• 0x42a314 RegisterClassA

• 0x42a318 GetSysColor

• 0x42a31c AdjustWindowRectEx

• 0x42a320 CopyRect

• 0x42a324 PtInRect

• 0x42a328 GetDlgCtrlID

• 0x42a32c DefWindowProcA

• 0x42a330 CallWindowProcA

• 0x42a334 GetMenu

• 0x42a338 SetWindowLongA

• 0x42a33c SetWindowPos

• 0x42a340 IsRectEmpty

• 0x42a344 DrawIcon

• 0x42a348 AppendMenuA

• 0x42a34c SendMessageA

• 0x42a350 SystemParametersInfoA

• 0x42a354 GetWindowPlacement

• 0x42a358 GetWindow

• 0x42a35c GetDesktopWindow

• 0x42a360 SetActiveWindow

• 0x42a364 CreateDialogIndirectParamA

• 0x42a368 DestroyWindow

• 0x42a36c IsWindow

• 0x42a370 GetDlgItem

• 0x42a374 GetNextDlgTabItem

• 0x42a378 EndDialog

• 0x42a37c GetWindowThreadProcessId

• 0x42a380 UnregisterClassA

• 0x42a384 GetForegroundWindow

• 0x42a388 GetSystemMenu

• 0x42a38c IsIconic

• 0x42a390 GetWindowRect

• 0x42a394 GetClientRect

• 0x42a398 InvalidateRect

• 0x42a39c IsWindowVisible

• 0x42a3a0 EnableWindow

• 0x42a3a4 LoadIconA

• 0x42a3a8 GetSystemMetrics

• 0x42a3ac PostQuitMessage

• 0x42a3b0 PostMessageA

• 0x42a3b4 CheckMenuItem

• 0x42a3b8 EnableMenuItem

• 0x42a3bc GetMenuState

• 0x42a3c0 ModifyMenuA

• 0x42a3c4 GetParent

• 0x42a3c8 GetFocus

• 0x42a3cc LoadBitmapA

• 0x42a3d0 GetMenuCheckMarkDimensions

• 0x42a3d4 SetMenuItemBitmaps

• 0x42a3d8 ValidateRect

• 0x42a3dc GetWindowLongA

• 0x42a3e0 GetLastActivePopup

• 0x42a3e4 IsWindowEnabled

• 0x42a3e8 MessageBoxA

• 0x42a3ec SetCursor

• 0x42a3f0 SetWindowsHookExA

• 0x42a3f4 CallNextHookEx

• 0x42a3f8 GetMessageA

• 0x42a3fc TranslateMessage

• 0x42a400 DispatchMessageA

• 0x42a404 GetActiveWindow

• 0x42a408 GetKeyState

• 0x42a40c PeekMessageA

• 0x42a410 GetCursorPos

• 0x42a414 GetWindowTextA

Library GDI32.dll:

• 0x42a028 ScaleWindowExtEx

• 0x42a02c DeleteDC

• 0x42a030 GetStockObject

• 0x42a034 SetWindowExtEx

• 0x42a038 ScaleViewportExtEx

• 0x42a03c SetViewportExtEx

• 0x42a040 OffsetViewportOrgEx

• 0x42a044 SetViewportOrgEx

• 0x42a048 SelectObject

• 0x42a04c Escape

• 0x42a050 TextOutA

• 0x42a054 RectVisible

• 0x42a058 PtVisible

• 0x42a05c CreateBitmap

• 0x42a060 DeleteObject

• 0x42a064 SetMapMode

• 0x42a068 RestoreDC

• 0x42a06c SaveDC

• 0x42a070 ExtTextOutA

• 0x42a074 GetDeviceCaps

• 0x42a078 GetObjectA

• 0x42a07c SetBkColor

• 0x42a080 SetTextColor

• 0x42a084 GetClipBox

Library WINSPOOL.DRV:

• 0x42a41c DocumentPropertiesA

• 0x42a420 OpenPrinterA

• 0x42a424 ClosePrinter

Library ADVAPI32.dll:

• 0x42a000 RegSetValueExA

• 0x42a004 RegCreateKeyExA

• 0x42a008 RegQueryValueA

• 0x42a00c RegOpenKeyA

• 0x42a010 RegEnumKeyA

• 0x42a014 RegDeleteKeyA

• 0x42a018 RegOpenKeyExA

• 0x42a01c RegQueryValueExA

• 0x42a020 RegCloseKey

Library SHELL32.dll:

• 0x42a258 SHBrowseForFolderA

• 0x42a25c SHGetPathFromIDListA

Library SHLWAPI.dll:

• 0x42a264 PathFindFileNameA

• 0x42a268 PathFindExtensionA

Library ole32.dll:

• 0x42a42c CoInitializeEx

• 0x42a430 CoGetMalloc

• 0x42a434 CoUninitialize

Library OLEAUT32.dll:

• 0x42a248 VariantClear

• 0x42a24c VariantChangeType

• 0x42a250 VariantInit

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.