6.0
高危
56 个模型检测该样本为恶意！
重新分析
更多

27dbff4b16fa15497def710d494b48ad90c3a498c354cee50fc0e35081dcfbb7

dcc4e3a64f72ee55fb7e1fb1b93d8dc6.exe

分析耗时

79s

最近分析

文件大小

273.1KB
静态报毒 动态报毒 100% AGEN AI SCORE=87 AIDETECTGBM AM0@AWCBYLJ ARTEMIS CONFIDENCE DCSTL DISCORD DISCORDNET DISCOSTEALER DO3Z5ULFUKO GENERICKD HPNCVU HWYDXQWA KCLOUD KERP M1GL7NIAX2L MALWARE@#31D9TK9NOTCGD PSWTROJ PWSX QQPASS QQROB R002C0DKJ20 RAZY SCORE TROJANPSW TSCOPE UNSAFE WVKM ZEMSILF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Artemis!DCC4E3A64F72 20210224 6.0.6.653
Alibaba TrojanPSW:MSIL/Dcstl.c94496ac 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_100% (W) 20210203 1.0
Baidu 20190318 1.0.0.2
Avast Win32:PWSX-gen [Trj] 20210224 21.1.5827.0
Tencent Msil.Trojan-qqpass.Qqrob.Wvkm 20210224 1.0.0.1
Kingsoft Win32.PSWTroj.Undef.(kcloud) 20210224 2017.9.26.565
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619956907.615499
GetComputerNameA
computer_name: OSKAR-PC
success 1 0
1619956907.615499
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (4 个事件)
Time & API Arguments Status Return Repeated
1619956906.881499
IsDebuggerPresent
failed 0 0
1619956906.881499
IsDebuggerPresent
failed 0 0
1619956907.584499
IsDebuggerPresent
failed 0 0
1619956907.600499
IsDebuggerPresent
failed 0 0
Command line console output was observed (12 个事件)
Time & API Arguments Status Return Repeated
1619956872.053626
WriteConsoleW
buffer: Loading,,, [][][][][][][][][][] 0
console_handle: 0x00000007
success 1 0
1619956874.709626
WriteConsoleW
buffer: Loading,,, ()[][][][][][][][][] 10
console_handle: 0x00000007
success 1 0
1619956877.303626
WriteConsoleW
buffer: Loading,,, ()()[][][][][][][][] 20
console_handle: 0x00000007
success 1 0
1619956879.990626
WriteConsoleW
buffer: Loading,,, ()()()[][][][][][][] 30
console_handle: 0x00000007
success 1 0
1619956882.631626
WriteConsoleW
buffer: Loading,,, ()()()()[][][][][][] 40
console_handle: 0x00000007
success 1 0
1619956885.381626
WriteConsoleW
buffer: Loading,,, ()()()()()[][][][][] 50
console_handle: 0x00000007
success 1 0
1619956887.959626
WriteConsoleW
buffer: Loading,,, ()()()()()()[][][][] 60
console_handle: 0x00000007
success 1 0
1619956890.709626
WriteConsoleW
buffer: Loading,,, ()()()()()()()[][][] 70
console_handle: 0x00000007
success 1 0
1619956893.303626
WriteConsoleW
buffer: Loading,,, ()()()()()()()()[][] 80
console_handle: 0x00000007
success 1 0
1619956898.178626
WriteConsoleW
buffer: Loading,,, ()()()()()()()()()[] 90
console_handle: 0x00000007
success 1 0
1619956901.240626
WriteConsoleW
buffer: Loading,,, ()()()()()()()()()() 100
console_handle: 0x00000007
success 1 0
1619956904.022626
WriteConsoleW
buffer: COMPLITE!
console_handle: 0x00000007
success 1 0
This executable has a PDB path (1 个事件)
pdb_path d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619956867.881499
GlobalMemoryStatusEx
success 1 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (48 个事件)
Time & API Arguments Status Return Repeated
1619956865.834374
NtProtectVirtualMemory
process_identifier: 2284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75121000
success 0 0
1619956865.975374
NtProtectVirtualMemory
process_identifier: 2284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75101000
success 0 0
1619956866.881374
NtProtectVirtualMemory
process_identifier: 2284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75a11000
success 0 0
1619956866.881374
NtProtectVirtualMemory
process_identifier: 2284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x766c1000
success 0 0
1619956866.881374
NtProtectVirtualMemory
process_identifier: 2284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77691000
success 0 0
1619956867.897499
NtProtectVirtualMemory
process_identifier: 192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74791000
success 0 0
1619956872.475374
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74771000
success 0 0
1619956875.100999
NtProtectVirtualMemory
process_identifier: 1940
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74791000
success 0 0
1619956877.725374
NtProtectVirtualMemory
process_identifier: 1908
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74771000
success 0 0
1619956880.397499
NtProtectVirtualMemory
process_identifier: 3060
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74791000
success 0 0
1619956883.069501
NtProtectVirtualMemory
process_identifier: 2296
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74771000
success 0 0
1619956885.756501
NtProtectVirtualMemory
process_identifier: 2952
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74791000
success 0 0
1619956888.428876
NtProtectVirtualMemory
process_identifier: 2456
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74771000
success 0 0
1619956891.115626
NtProtectVirtualMemory
process_identifier: 1036
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74791000
success 0 0
1619956893.709751
NtProtectVirtualMemory
process_identifier: 2412
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74771000
success 0 0
1619956898.647999
NtProtectVirtualMemory
process_identifier: 3168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74791000
success 0 0
1619956901.726124
NtProtectVirtualMemory
process_identifier: 3320
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74771000
success 0 0
1619956906.209499
NtProtectVirtualMemory
process_identifier: 3440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74731000
success 0 0
1619956906.459499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 1310720
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x007d0000
success 0 0
1619956906.459499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x008d0000
success 0 0
1619956906.678499
NtProtectVirtualMemory
process_identifier: 3440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1619956906.678499
NtProtectVirtualMemory
process_identifier: 3440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74671000
success 0 0
1619956906.725499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x00af0000
success 0 0
1619956906.725499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00c70000
success 0 0
1619956906.819499
NtProtectVirtualMemory
process_identifier: 3440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e71000
success 0 0
1619956906.881499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x02610000
success 0 0
1619956906.881499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02780000
success 0 0
1619956906.897499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0054a000
success 0 0
1619956906.897499
NtProtectVirtualMemory
process_identifier: 3440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x73e72000
success 0 0
1619956906.897499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00542000
success 0 0
1619956907.084499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00552000
success 0 0
1619956907.162499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00575000
success 0 0
1619956907.162499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0057b000
success 0 0
1619956907.162499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00577000
success 0 0
1619956907.240499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00553000
success 0 0
1619956907.287499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0055c000
success 0 0
1619956907.334499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00770000
success 0 0
1619956907.584499
NtProtectVirtualMemory
process_identifier: 3440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74601000
success 0 0
1619956907.584499
NtAllocateVirtualMemory
process_identifier: 3440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02781000
success 0 0
1619956907.662499
NtProtectVirtualMemory
process_identifier: 3440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74551000
success 0 0
1619956912.350751
NtProtectVirtualMemory
process_identifier: 3540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74791000
success 0 0
1619956912.365751
NtProtectVirtualMemory
process_identifier: 3540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75101000
success 0 0
1619956912.459751
NtProtectVirtualMemory
process_identifier: 3540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75c41000
success 0 0
1619956912.459751
NtProtectVirtualMemory
process_identifier: 3540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76121000
success 0 0
1619956912.475751
NtProtectVirtualMemory
process_identifier: 3540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74701000
success 0 0
1619956912.522751
NtProtectVirtualMemory
process_identifier: 3540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74801000
success 0 0
1619956912.569751
NtProtectVirtualMemory
process_identifier: 3540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x746a1000
success 0 0
1619956912.569751
NtProtectVirtualMemory
process_identifier: 3540
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74611000
success 0 0
Creates executable files on the filesystem (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\install.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\loading.bat
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\Complite.vbs
Drops a binary and executes it (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\loading.bat
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\install.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\Complite.vbs
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\RarSFX2\install.exe
Uses Windows utilities for basic Windows functionality (2 个事件)
cmdline ping -n 2 127.0.0.1
cmdline ping -n 4 127.0.0.1
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2284 resumed a thread in remote process 3540
Time & API Arguments Status Return Repeated
1619956912.069374
NtResumeThread
thread_handle: 0x000002b0
suspend_count: 1
process_identifier: 3540
success 0 0
The process wscript.exe wrote an executable file to disk (1 个事件)
file C:\Windows\SysWOW64\wscript.exe
File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 个事件)
Bkav W32.AIDetectGBM.malware.02
MicroWorld-eScan Trojan.GenericKD.34247213
McAfee Artemis!DCC4E3A64F72
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Infostealer.MSIL.Dcstl.GA!MTB
K7AntiVirus Password-Stealer ( 0054da731 )
Alibaba TrojanPSW:MSIL/Dcstl.c94496ac
K7GW Password-Stealer ( 0054da731 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D20A922D
Cyren W32/Trojan.KERP-4872
Symantec Trojan.Gen.2
APEX Malicious
Avast Win32:PWSX-gen [Trj]
ClamAV Win.Packed.Razy-9789215-0
Kaspersky HEUR:Trojan-PSW.MSIL.DiscoStealer.gen
BitDefender Trojan.GenericKD.34247213
NANO-Antivirus Trojan.Win32.DiscoStealer.hpncvu
Tencent Msil.Trojan-qqpass.Qqrob.Wvkm
Ad-Aware Trojan.GenericKD.34247213
Emsisoft Trojan.GenericKD.34247213 (B)
Comodo Malware@#31d9tk9notcgd
F-Secure Heuristic.HEUR/AGEN.1136127
DrWeb Trojan.PWS.DiscordNET.12
Zillya Trojan.Discord.Win32.1234
TrendMicro TROJ_GEN.R002C0DKJ20
McAfee-GW-Edition BehavesLike.Win32.Generic.dh
FireEye Trojan.GenericKD.34247213
Sophos Mal/Generic-R
Paloalto generic.ml
Jiangmin Trojan.PSW.MSIL.vpu
Avira HEUR/AGEN.1136127
eGambit Generic.Malware
MAX malware (ai score=87)
Antiy-AVL Trojan[PSW]/MSIL.Stealer
Kingsoft Win32.PSWTroj.Undef.(kcloud)
Microsoft PWS:MSIL/Dcstl.GA!MTB
AegisLab Trojan.MSIL.DiscoStealer.i!c
ZoneAlarm HEUR:Trojan-PSW.MSIL.DiscoStealer.gen
GData Trojan.GenericKD.34247213
Cynet Malicious (score: 85)
VBA32 TScope.Trojan.MSIL
ALYac Trojan.GenericKD.34247213
Malwarebytes Generic.Malware/Suspicious
ESET-NOD32 a variant of MSIL/PSW.Discord.AT
TrendMicro-HouseCall TROJ_GEN.R002C0DKJ20
Rising Stealer.Discord!8.10A86 (TFE:C:M1gL7niAX2L)
Yandex Trojan.PWS.Discord!do3Z5UlFuKo
Ikarus Trojan.MSIL.PSW
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2015-02-15 16:00:31

Imports

Library COMCTL32.dll:
Library SHLWAPI.dll:
• 0x42a298 SHAutoComplete
Library KERNEL32.dll:
• 0x42a068 FindClose
• 0x42a06c FindNextFileW
• 0x42a070 FindFirstFileW
• 0x42a074 GetVersionExW
• 0x42a07c GetFullPathNameW
• 0x42a080 GetModuleFileNameW
• 0x42a084 FindResourceW
• 0x42a088 GetModuleHandleW
• 0x42a08c FreeLibrary
• 0x42a090 GetProcAddress
• 0x42a094 LoadLibraryW
• 0x42a098 GetCurrentProcessId
• 0x42a09c GetLocaleInfoW
• 0x42a0a0 GetNumberFormatW
• 0x42a0ac WaitForSingleObject
• 0x42a0b0 GetDateFormatW
• 0x42a0b4 GetTimeFormatW
• 0x42a0c0 GetExitCodeProcess
• 0x42a0c4 GetTempPathW
• 0x42a0c8 MoveFileExW
• 0x42a0cc UnmapViewOfFile
• 0x42a0d0 Sleep
• 0x42a0d4 MapViewOfFile
• 0x42a0d8 GetCommandLineW
• 0x42a0dc CreateFileMappingW
• 0x42a0e0 GetTickCount
• 0x42a0e4 OpenFileMappingW
• 0x42a0f8 CreateThread
• 0x42a100 CreateEventW
• 0x42a104 CreateSemaphoreW
• 0x42a108 ReleaseSemaphore
• 0x42a10c ResetEvent
• 0x42a110 SetEvent
• 0x42a114 SetThreadPriority
• 0x42a11c GetSystemTime
• 0x42a12c WideCharToMultiByte
• 0x42a130 MultiByteToWideChar
• 0x42a134 CompareStringW
• 0x42a138 IsDBCSLeadByte
• 0x42a13c SetFileTime
• 0x42a140 SetFileAttributesW
• 0x42a148 WriteConsoleW
• 0x42a14c GetConsoleOutputCP
• 0x42a150 WriteConsoleA
• 0x42a154 SetStdHandle
• 0x42a158 GetLocaleInfoA
• 0x42a15c GetStringTypeW
• 0x42a160 GetStringTypeA
• 0x42a164 LoadLibraryA
• 0x42a168 GetConsoleMode
• 0x42a16c GetConsoleCP
• 0x42a178 SetHandleCount
• 0x42a18c GetModuleHandleA
• 0x42a190 LCMapStringW
• 0x42a194 LCMapStringA
• 0x42a198 IsValidCodePage
• 0x42a19c GetOEMCP
• 0x42a1a0 GetACP
• 0x42a1a4 GetModuleFileNameA
• 0x42a1a8 ExitProcess
• 0x42a1ac HeapSize
• 0x42a1b0 IsDebuggerPresent
• 0x42a1bc TerminateProcess
• 0x42a1c0 VirtualAlloc
• 0x42a1c4 VirtualFree
• 0x42a1c8 HeapCreate
• 0x42a1d0 GetCurrentThreadId
• 0x42a1d8 TlsFree
• 0x42a1dc TlsSetValue
• 0x42a1e0 TlsAlloc
• 0x42a1e4 TlsGetValue
• 0x42a1e8 GetStartupInfoA
• 0x42a1ec GetCommandLineA
• 0x42a1f0 RaiseException
• 0x42a1f4 GetFileAttributesW
• 0x42a1f8 FlushFileBuffers
• 0x42a1fc ReadFile
• 0x42a200 GetFileType
• 0x42a204 SetEndOfFile
• 0x42a208 SetFilePointer
• 0x42a20c WriteFile
• 0x42a210 GetStdHandle
• 0x42a214 GetLongPathNameW
• 0x42a218 GetShortPathNameW
• 0x42a21c GlobalAlloc
• 0x42a220 MoveFileW
• 0x42a224 CreateFileW
• 0x42a228 CreateDirectoryW
• 0x42a22c DeviceIoControl
• 0x42a230 RemoveDirectoryW
• 0x42a234 DeleteFileW
• 0x42a238 CreateHardLinkW
• 0x42a23c GetCurrentProcess
• 0x42a240 CloseHandle
• 0x42a244 SetLastError
• 0x42a248 GetLastError
• 0x42a24c CreateFileA
• 0x42a250 GetCPInfo
• 0x42a258 HeapAlloc
• 0x42a25c HeapReAlloc
• 0x42a260 HeapFree
• 0x42a264 RtlUnwind
Library USER32.dll:
• 0x42a2a0 EnableWindow
• 0x42a2a4 GetDlgItem
• 0x42a2a8 ShowWindow
• 0x42a2ac SetWindowLongW
• 0x42a2b0 GetDC
• 0x42a2b4 ReleaseDC
• 0x42a2b8 FindWindowExW
• 0x42a2bc GetParent
• 0x42a2c0 MapWindowPoints
• 0x42a2c4 CreateWindowExW
• 0x42a2c8 UpdateWindow
• 0x42a2cc LoadCursorW
• 0x42a2d0 RegisterClassExW
• 0x42a2d4 DefWindowProcW
• 0x42a2d8 DestroyWindow
• 0x42a2dc CopyRect
• 0x42a2e0 IsWindow
• 0x42a2e4 CharUpperW
• 0x42a2e8 OemToCharBuffA
• 0x42a2ec LoadIconW
• 0x42a2f0 LoadBitmapW
• 0x42a2f4 PostMessageW
• 0x42a2f8 GetSysColor
• 0x42a2fc SetForegroundWindow
• 0x42a300 MessageBoxW
• 0x42a304 WaitForInputIdle
• 0x42a308 IsWindowVisible
• 0x42a30c DialogBoxParamW
• 0x42a310 DestroyIcon
• 0x42a314 SetFocus
• 0x42a318 GetClassNameW
• 0x42a31c SendDlgItemMessageW
• 0x42a320 EndDialog
• 0x42a324 GetDlgItemTextW
• 0x42a328 SetDlgItemTextW
• 0x42a32c wvsprintfW
• 0x42a330 SendMessageW
• 0x42a334 PeekMessageW
• 0x42a338 GetMessageW
• 0x42a33c TranslateMessage
• 0x42a340 DispatchMessageW
• 0x42a344 LoadStringW
• 0x42a348 GetWindowRect
• 0x42a34c GetClientRect
• 0x42a350 SetWindowPos
• 0x42a354 GetWindowTextW
• 0x42a358 SetWindowTextW
• 0x42a35c GetSystemMetrics
• 0x42a360 GetWindow
• 0x42a364 GetWindowLongW
Library GDI32.dll:
• 0x42a040 GetDeviceCaps
• 0x42a044 CreateCompatibleDC
• 0x42a04c SelectObject
• 0x42a050 StretchBlt
• 0x42a054 DeleteDC
• 0x42a058 GetObjectW
• 0x42a05c DeleteObject
• 0x42a060 CreateDIBSection
Library COMDLG32.dll:
• 0x42a030 GetSaveFileNameW
• 0x42a038 GetOpenFileNameW
Library ADVAPI32.dll:
• 0x42a000 RegOpenKeyExW
• 0x42a004 RegQueryValueExW
• 0x42a008 RegCreateKeyExW
• 0x42a00c RegSetValueExW
• 0x42a010 RegCloseKey
• 0x42a014 SetFileSecurityW
• 0x42a018 OpenProcessToken
Library SHELL32.dll:
• 0x42a274 SHBrowseForFolderW
• 0x42a278 ShellExecuteExW
• 0x42a280 SHFileOperationW
• 0x42a288 SHGetMalloc
• 0x42a28c SHChangeNotify
• 0x42a290 SHGetFileInfoW
Library ole32.dll:
• 0x42a36c CLSIDFromString
• 0x42a370 CoCreateInstance
• 0x42a374 OleInitialize
• 0x42a378 OleUninitialize
Library OLEAUT32.dll:
• 0x42a26c VariantInit

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.