5.0
中危
52 个模型检测该样本为恶意！
重新分析
更多

5f97741d6beab5fb38e7821c36e7e2662fc3dfc7d01f1248d844599e0bbd730d

dd3f0bd96b1982bb57542f02695ec257.exe

分析耗时

76s

最近分析

文件大小

2.2MB
静态报毒 动态报毒 AI SCORE=100 ARTEMIS BUGBUGO BUGO CLOUD CONFIDENCE FILECODER FILECRYPTER HIGH CONFIDENCE HJKWCB IJNU KCLOUD MT04TQCSUWA OCCAMY RAMNIT SCORE SUSGEN UNSAFE WACATAC WSKD ZNVPI 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba Trojan:Win64/Filecoder.b7a3e6eb 20190527 0.3.0.5
CrowdStrike win/malicious_confidence_80% (W) 20210203 1.0
Avast Win64:Malware-gen 20210221 21.1.5827.0
Tencent Win32.Trojan.Encoder.Wskd 20210221 1.0.0.1
Baidu 20190318 1.0.0.2
Kingsoft Win32.Troj.Undef.(kcloud) 20210221 2017.9.26.565
McAfee Artemis!DD3F0BD96B19 20210221 6.0.6.653
行为判定
动态指标
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Attempts to detect Cuckoo Sandbox through the presence of a file (2 个事件)
file c:\Python27\agent.pyw
file c:\tmpsij43m\analyzer.py
Appends a known multi-family ransomware file extension to files that have been encrypted (50 out of 78 个事件)
file c:\Python27\tcl\tcl8.5\encoding\macUkraine.enc
file c:\Python27\tcl\tcl8.5\encoding\big5.enc
file c:\Python27\tcl\tcl8.5\encoding\cp936.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1250.enc
file c:\Python27\tcl\tcl8.5\encoding\cp869.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-5.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1252.enc
file c:\Python27\tcl\tcl8.5\encoding\macGreek.enc
file c:\Python27\tcl\tcl8.5\encoding\macCroatian.enc
file c:\Python27\tcl\tcl8.5\encoding\koi8-r.enc
file c:\Python27\tcl\tcl8.5\encoding\ascii.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1258.enc
file c:\Python27\tcl\tcl8.5\encoding\jis0201.enc
file c:\Python27\tcl\tcl8.5\encoding\macCentEuro.enc
file c:\Python27\tcl\tcl8.5\encoding\cp850.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1251.enc
file c:\Python27\tcl\tcl8.5\encoding\koi8-u.enc
file c:\Python27\tcl\tcl8.5\encoding\euc-jp.enc
file c:\Python27\tcl\tcl8.5\encoding\jis0208.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-1.enc
file c:\Python27\tcl\tcl8.5\encoding\cp857.enc
file c:\Python27\tcl\tcl8.5\encoding\cp950.enc
file c:\Python27\tcl\tcl8.5\encoding\gb12345.enc
file c:\Python27\tcl\tcl8.5\encoding\ebcdic.enc
file c:\Python27\tcl\tcl8.5\encoding\macIceland.enc
file c:\Python27\tcl\tcl8.5\encoding\macCyrillic.enc
file c:\Python27\tcl\tcl8.5\encoding\cp862.enc
file c:\Python27\tcl\tcl8.5\encoding\iso2022-kr.enc
file c:\Python27\tcl\tcl8.5\encoding\jis0212.enc
file c:\Python27\tcl\tcl8.5\encoding\cp864.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-16.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1256.enc
file c:\Python27\tcl\tcl8.5\encoding\macJapan.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1253.enc
file c:\Python27\tcl\tcl8.5\encoding\symbol.enc
file c:\Python27\tcl\tcl8.5\encoding\cp855.enc
file c:\Python27\tcl\tcl8.5\encoding\cp852.enc
file c:\Python27\tcl\tcl8.5\encoding\cp866.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-3.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-10.enc
file c:\Python27\tcl\tcl8.5\encoding\iso2022.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-4.enc
file c:\Python27\tcl\tcl8.5\encoding\euc-cn.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-7.enc
file c:\Python27\tcl\tcl8.5\encoding\iso8859-6.enc
file c:\Python27\tcl\tcl8.5\encoding\cp863.enc
file c:\Python27\tcl\tcl8.5\encoding\macRoman.enc
file c:\Python27\tcl\tcl8.5\encoding\cp874.enc
file c:\Python27\tcl\tcl8.5\encoding\gb2312-raw.enc
file c:\Python27\tcl\tcl8.5\encoding\cp1254.enc
Writes a potential ransom message to disk (4 个事件)
Time & API Arguments Status Return Repeated
1619964564.093388
NtWriteFile
file_handle: 0x0000000000000090
filepath: C:\Users\Administrator.Oskar-PC\Desktop\Read_Bug.html
buffer: <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Bug</title> </head> <body style="background-color: black"> <h1 style="color: white; text-align: center;">BUG</h1> <h2 style="color: red; text-align: center;">You File is Encrypt</h2> <h2 style="color: red; text-align: center;">Contact Email: bugbugo@protonmail.com</h2> <h2 style="color: red; text-align: center;">Decrypt ID:</h2> <h3 style="color: gray;word-wrap: break-word;">W7OFISXJe5jD6WqIltqqSPcnO/2YOK6Ckzaqgc672Y1LRRg35CGWJ/gOz69Lvr+yK8aWxOAWFI0Nj+5vEC/Xj528vIh0K/++jLHdahsig1bVvscBJSi3SpEnfi/Vy2mAHftUn2KpockmQemLgalhSZuDr3/+MaH7lU3LVkd5jgx7/LGbMzSBSR16HLCYpgehzOpUG8/qm3dsfm1O8qAn1+nUlozcA4u1I/JqtE63KA7qCl8/SEztoLdteqik6CxyonLjacNHCdse1BjylnuT3m3m+UpvcNG77Usc75SfG7VDAstpSb8H2Hdj5xk/d51HkId8MKh4cRhZ1ZJ3VFmtsQ==</h3> </body> </html>
offset: 0
success 0 0
1619964564.109388
NtWriteFile
file_handle: 0x0000000000000090
filepath: C:\Users\Administrator.Oskar-PC\Documents\Read_Bug.html
buffer: <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Bug</title> </head> <body style="background-color: black"> <h1 style="color: white; text-align: center;">BUG</h1> <h2 style="color: red; text-align: center;">You File is Encrypt</h2> <h2 style="color: red; text-align: center;">Contact Email: bugbugo@protonmail.com</h2> <h2 style="color: red; text-align: center;">Decrypt ID:</h2> <h3 style="color: gray;word-wrap: break-word;">W7OFISXJe5jD6WqIltqqSPcnO/2YOK6Ckzaqgc672Y1LRRg35CGWJ/gOz69Lvr+yK8aWxOAWFI0Nj+5vEC/Xj528vIh0K/++jLHdahsig1bVvscBJSi3SpEnfi/Vy2mAHftUn2KpockmQemLgalhSZuDr3/+MaH7lU3LVkd5jgx7/LGbMzSBSR16HLCYpgehzOpUG8/qm3dsfm1O8qAn1+nUlozcA4u1I/JqtE63KA7qCl8/SEztoLdteqik6CxyonLjacNHCdse1BjylnuT3m3m+UpvcNG77Usc75SfG7VDAstpSb8H2Hdj5xk/d51HkId8MKh4cRhZ1ZJ3VFmtsQ==</h3> </body> </html>
offset: 0
success 0 0
1619964564.109388
NtWriteFile
file_handle: 0x0000000000000090
filepath: C:\Python27\Read_Bug.html
buffer: <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Bug</title> </head> <body style="background-color: black"> <h1 style="color: white; text-align: center;">BUG</h1> <h2 style="color: red; text-align: center;">You File is Encrypt</h2> <h2 style="color: red; text-align: center;">Contact Email: bugbugo@protonmail.com</h2> <h2 style="color: red; text-align: center;">Decrypt ID:</h2> <h3 style="color: gray;word-wrap: break-word;">W7OFISXJe5jD6WqIltqqSPcnO/2YOK6Ckzaqgc672Y1LRRg35CGWJ/gOz69Lvr+yK8aWxOAWFI0Nj+5vEC/Xj528vIh0K/++jLHdahsig1bVvscBJSi3SpEnfi/Vy2mAHftUn2KpockmQemLgalhSZuDr3/+MaH7lU3LVkd5jgx7/LGbMzSBSR16HLCYpgehzOpUG8/qm3dsfm1O8qAn1+nUlozcA4u1I/JqtE63KA7qCl8/SEztoLdteqik6CxyonLjacNHCdse1BjylnuT3m3m+UpvcNG77Usc75SfG7VDAstpSb8H2Hdj5xk/d51HkId8MKh4cRhZ1ZJ3VFmtsQ==</h3> </body> </html>
offset: 0
success 0 0
1619964564.125388
NtWriteFile
file_handle: 0x00000000000000b4
filepath: C:\tmpsij43m\Read_Bug.html
buffer: <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Bug</title> </head> <body style="background-color: black"> <h1 style="color: white; text-align: center;">BUG</h1> <h2 style="color: red; text-align: center;">You File is Encrypt</h2> <h2 style="color: red; text-align: center;">Contact Email: bugbugo@protonmail.com</h2> <h2 style="color: red; text-align: center;">Decrypt ID:</h2> <h3 style="color: gray;word-wrap: break-word;">W7OFISXJe5jD6WqIltqqSPcnO/2YOK6Ckzaqgc672Y1LRRg35CGWJ/gOz69Lvr+yK8aWxOAWFI0Nj+5vEC/Xj528vIh0K/++jLHdahsig1bVvscBJSi3SpEnfi/Vy2mAHftUn2KpockmQemLgalhSZuDr3/+MaH7lU3LVkd5jgx7/LGbMzSBSR16HLCYpgehzOpUG8/qm3dsfm1O8qAn1+nUlozcA4u1I/JqtE63KA7qCl8/SEztoLdteqik6CxyonLjacNHCdse1BjylnuT3m3m+UpvcNG77Usc75SfG7VDAstpSb8H2Hdj5xk/d51HkId8MKh4cRhZ1ZJ3VFmtsQ==</h3> </body> </html>
offset: 0
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 2216 resumed a thread in remote process 192
Time & API Arguments Status Return Repeated
1619964542.56349
NtResumeThread
thread_handle: 0x000000000000005c
suspend_count: 0
process_identifier: 192
success 0 0
Detects the presence of Wine emulator (2 个事件)
Time & API Arguments Status Return Repeated
1619964541.990021
LdrGetProcedureAddress
ordinal: 0
module: ntdll
module_address: 0x0000000077b50000
function_address: 0x000007feff3b7a50
function_name: wine_get_version
failed -1073741511 0
1619964542.687388
LdrGetProcedureAddress
ordinal: 0
module: ntdll
module_address: 0x0000000077b50000
function_address: 0x000007feff3b7a50
function_name: wine_get_version
failed -1073741511 0
File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)
Elastic malicious (high confidence)
MicroWorld-eScan Generic.Ransom.BugBugo.36838D91
FireEye Generic.Ransom.BugBugo.36838D91
ALYac Trojan.Ransom.Filecoder
Cylance Unsafe
Zillya Trojan.Filecoder.Win64.9030
Sangfor Ransom.Win32.Encoder.hzw
K7AntiVirus Riskware ( 0040eff71 )
Alibaba Trojan:Win64/Filecoder.b7a3e6eb
K7GW Riskware ( 0040eff71 )
CrowdStrike win/malicious_confidence_80% (W)
Arcabit Generic.Ransom.BugBugo.36838D91
Cyren W64/Ransom.IJNU-7272
Symantec Downloader
APEX Malicious
Avast Win64:Malware-gen
Kaspersky Trojan-Ransom.Win32.Encoder.hzw
BitDefender Generic.Ransom.BugBugo.36838D91
NANO-Antivirus Trojan.Win64.Encoder.hjkwcb
Paloalto generic.ml
Tencent Win32.Trojan.Encoder.Wskd
Ad-Aware Generic.Ransom.BugBugo.36838D91
Sophos Mal/Generic-S
F-Secure Trojan.TR/FileCoder.znvpi
DrWeb Trojan.Encoder.31539
TrendMicro Ransom.Win64.BUGO.A
McAfee-GW-Edition BehavesLike.Win64.Ramnit.vm
Emsisoft Generic.Ransom.BugBugo.36838D91 (B)
Ikarus Trojan-Ransom.FileCrypter
Jiangmin Trojan.Encoder.ul
Avira TR/FileCoder.znvpi
Antiy-AVL Trojan/Win32.Wacatac
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win64.Filecoder.ko
Microsoft Trojan:Win32/Occamy.C5F
ZoneAlarm Trojan-Ransom.Win32.Encoder.hzw
GData Generic.Ransom.BugBugo.36838D91
Cynet Malicious (score: 100)
McAfee Artemis!DD3F0BD96B19
MAX malware (ai score=100)
VBA32 TrojanRansom.Encoder
Malwarebytes Ransom.bugbugo
ESET-NOD32 a variant of Win64/Filecoder.BP
TrendMicro-HouseCall Ransom.Win64.BUGO.A
Rising Ransom.Encoder!8.FFD4 (CLOUD)
Yandex Trojan.Filecoder!mt04TqcSUWA
MaxSecure Trojan.Malware.73926358.susgen
Fortinet W64/Filecoder.C257!tr.ransom
AVG Win64:Malware-gen
Cybereason malicious.96b198
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1970-01-01 08:00:00

Imports

Library KERNEL32.DLL:
• 0x627000 WriteFile
• 0x627008 WriteConsoleW
• 0x627010 WaitForSingleObject
• 0x627018 VirtualQuery
• 0x627020 VirtualFree
• 0x627028 VirtualAlloc
• 0x627030 SwitchToThread
• 0x627038 SetWaitableTimer
• 0x627050 SetEvent
• 0x627058 SetErrorMode
• 0x627068 LoadLibraryA
• 0x627070 LoadLibraryW
• 0x627078 GetSystemInfo
• 0x627080 GetSystemDirectoryA
• 0x627088 GetStdHandle
• 0x6270a0 GetProcAddress
• 0x6270b0 GetConsoleMode
• 0x6270c0 ExitProcess
• 0x6270c8 DuplicateHandle
• 0x6270d0 CreateThread
• 0x6270e0 CreateEventA
• 0x6270e8 CloseHandle

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.