5.6
高危
56 个模型检测该样本为恶意！
重新分析
更多

d10b2371ee70189abe37e8f0779ce3ecca51fd896cdda991289dfe14eaae1a76

d9dd70b738279b11ddcf079b46774f08.exe

分析耗时

115s

最近分析

文件大小

117.0KB
静态报毒 动态报毒 100% 8TSH4HZCXV4 AI SCORE=81 AIDETECTVM ANKZBI6YQAP ATTRIBUTE CONFIDENCE DSIL FUGRAFA GDSDA GENCIRC GENERICRXKA GRAFTOR HCJV HIGH CONFIDENCE HIGHCONFIDENCE HVREIW HYW@ACH9RY KCLOUD KRYPTIK MALWARE1 MALWARE@#2ML1WNLWBJTD5 R06CC0DHN20 RANSOMWARE REVIL SCORE SODINOKIBI STATIC AI SUSGEN SUSPICIOUS PE UNSAFE WACATAC XPACK ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win32/Kryptik.e4feebec 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:Malware-gen 20201228 21.1.5827.0
Kingsoft Win32.Troj.Generic.yz.(kcloud) 20201228 2017.9.26.565
McAfee GenericRXKA-LD!D9DD70B73827 20201228 6.0.6.653
Tencent Malware.Win32.Gencirc.11839962 20201228 1.0.0.1
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
静态指标
Queries for the computername (1 个事件)
Time & API Arguments Status Return Repeated
1619967567.190876
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619967558.440876
IsDebuggerPresent
failed 0 0
Command line console output was observed (50 out of 64 个事件)
Time & API Arguments Status Return Repeated
1619967558.300876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967558.300876
WriteConsoleW
buffer: core_init() - Program initialization
console_handle: 0x00000007
success 1 0
1619967558.393876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967558.409876
WriteConsoleW
buffer: cfg:{"all":false,"pc_sk":"GNz4lDWCdwGBi0WOvWI+EmrAt5wjavhfF50X/gPKcmE=","ext":["2y8j9a964"]}
console_handle: 0x00000007
success 1 0
1619967558.409876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967558.409876
WriteConsoleW
buffer: start GUI
console_handle: 0x00000007
success 1 0
1619967560.471876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967560.487876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967562.565876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967562.612876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967564.815876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967564.815876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967566.846876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967566.862876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967568.940876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967568.956876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967571.050876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967571.065876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967573.425876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967573.456876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967576.456876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967576.471876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967579.003876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967579.003876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967581.237876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967581.237876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967583.768876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967583.784876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967587.065876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967587.065876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967589.581876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967589.581876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967593.050876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967593.065876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967595.846876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967595.846876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967599.081876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967599.096876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967602.018876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967602.018876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967604.753876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967604.768876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967607.893876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967607.893876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967610.675876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967610.690876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967614.018876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967614.018876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
1619967617.175876
WriteConsoleW
buffer: [DBG]
console_handle: 0x00000007
success 1 0
1619967617.206876
WriteConsoleW
buffer: start decrypt FILE
console_handle: 0x00000007
success 1 0
This executable has a PDB path (1 个事件)
pdb_path *************************\Debug\rwdec_x86_debug.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619967563.565876
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .qf9
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1619967563.534876
NtAllocateVirtualMemory
process_identifier: 912
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x04a00000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Creates a shortcut to an executable file (3 个事件)
file C:\Users\Administrator.Oskar-PC\Links\Desktop.lnk
file C:\Users\Administrator.Oskar-PC\Links\Downloads.lnk
file C:\Users\Administrator.Oskar-PC\Links\RecentPlaces.lnk
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.120292940145047 section {'size_of_data': '0x00004000', 'virtual_address': '0x0000c000', 'entropy': 7.120292940145047, 'name': '.rdata', 'virtual_size': '0x00003e0e'} description A section with a high entropy has been found
entropy 7.769117071828156 section {'size_of_data': '0x00000e00', 'virtual_address': '0x00010000', 'entropy': 7.769117071828156, 'name': '.data', 'virtual_size': '0x00000fd8'} description A section with a high entropy has been found
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.160.110:443
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Fugrafa.10828
FireEye Generic.mg.d9dd70b738279b11
ALYac Gen:Variant.Fugrafa.10828
Cylance Unsafe
AegisLab Trojan.Win32.Fugrafa.4!c
Sangfor Malware
K7AntiVirus Trojan ( 0056cd1e1 )
Alibaba Trojan:Win32/Kryptik.e4feebec
K7GW Trojan ( 0056cd1e1 )
Cybereason malicious.738279
Arcabit Trojan.Fugrafa.D2A4C
Cyren W32/Trojan.DSIL-5508
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
ClamAV Win.Ransomware.Sodinokibi-7013612-0
BitDefender Gen:Variant.Fugrafa.10828
NANO-Antivirus Trojan.Win32.Kryptik.hvreiw
Avast Win32:Malware-gen
Rising Ransom.Sodinokibi!8.10C26 (TFE:5:aNKZBi6YQAP)
Ad-Aware Gen:Variant.Fugrafa.10828
Sophos Mal/Generic-S
Comodo Malware@#2ml1wnlwbjtd5
F-Secure Trojan.TR/Crypt.XPACK.Gen
VIPRE Trojan.Win32.Generic!BT
TrendMicro Ransom_Sodinokibi.R06CC0DHN20
McAfee-GW-Edition BehavesLike.Win32.Dropper.ct
Emsisoft Gen:Variant.Fugrafa.10828 (B)
SentinelOne Static AI - Suspicious PE
Webroot W32.Malware.Gen
Avira TR/Crypt.XPACK.Gen
eGambit Unsafe.AI_Score_85%
Antiy-AVL Trojan/Win32.Wacatac
Kingsoft Win32.Troj.Generic.yz.(kcloud)
Gridinsoft Ransom.Win32.Wacatac.oa
Microsoft Ransom:Win32/Revil.SI!MTB
GData Win32.Trojan-Ransom.Sodinokibi.F
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win32.Generic.C3490719
Acronis suspicious
McAfee GenericRXKA-LD!D9DD70B73827
MAX malware (ai score=81)
ESET-NOD32 a variant of Win32/Kryptik.HCJV
TrendMicro-HouseCall Ransom_Sodinokibi.R06CC0DHN20
Tencent Malware.Win32.Gencirc.11839962
Yandex Trojan.Kryptik!8TsH4Hzcxv4
Ikarus Trojan-Ransom.Sodinokibi
MaxSecure Trojan.Malware.100850935.susgen
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-03-15 02:50:25

Imports

Library KERNEL32.dll:
• 0x40c010 CloseHandle
• 0x40c014 CreateThread
• 0x40c018 GetModuleHandleW
• 0x40c01c CopyFileW
• 0x40c020 MoveFileW
• 0x40c024 GetStdHandle
• 0x40c028 CreateFileW
• 0x40c02c WriteFile
• 0x40c030 OutputDebugStringW
• 0x40c03c HeapAlloc
• 0x40c040 HeapFree
• 0x40c044 SetEndOfFile
• 0x40c050 ExitProcess
• 0x40c054 GetCurrentThread
• 0x40c058 GetProcAddress
• 0x40c060 lstrlenW
• 0x40c064 LoadLibraryA
• 0x40c070 WriteConsoleW
• 0x40c074 OutputDebugStringA
• 0x40c078 DeleteFileW
• 0x40c080 GetProcessHeap
Library USER32.dll:
• 0x40c09c CheckDlgButton
• 0x40c0a0 IsDlgButtonChecked
• 0x40c0a4 EnableWindow
• 0x40c0a8 SetDlgItemTextW
• 0x40c0ac DialogBoxParamW
• 0x40c0b0 SendMessageW
• 0x40c0b4 SetDlgItemInt
• 0x40c0b8 GetDlgItem
• 0x40c0bc SetWindowTextW
• 0x40c0c0 wsprintfW
• 0x40c0c4 MessageBoxW
• 0x40c0c8 EndDialog
Library GDI32.dll:
• 0x40c008 CreateFontW
Library SHELL32.dll:
• 0x40c090 SHBrowseForFolderW
Library COMDLG32.dll:
• 0x40c000 GetOpenFileNameW

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.