0.9
低危
58 个模型检测该样本为恶意！
重新分析
更多

0ff47192983073d2861e8845b6b933cf9ea7bc9352532bfbc90582444fc2b189

0ff47192983073d2861e8845b6b933cf9ea7bc9352532bfbc90582444fc2b189.exe

分析耗时

193s

最近分析

386天前

文件大小

16.3KB
静态报毒 动态报毒 CVE FAMILY METATYPE PLATFORM TYPE UNKNOWN WIN32 TROJAN DOWNLOADER ULISES
鹰眼引擎
DACN 0.12
FACILE 1.00
IMCLNet 0.58
MFGraph 0.00
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba None 20190527 0.3.0.5
Avast Win32:Trojan-gen 20200325 18.4.3895.0
Baidu None 20190318 1.0.0.2
CrowdStrike win/malicious_confidence_100% (D) 20190702 1.0
Kingsoft None 20200325 2013.8.14.323
McAfee GenericRXAY-WR!DEF84E6CB456 20200324 6.0.6.653
Tencent Malware.Win32.Gencirc.10b900d1 20200325 1.0.0.1
静态指标
行为判定
动态指标
网络通信
与未执行 DNS 查询的主机进行通信 (1 个事件)
host 114.114.114.114
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意 (50 out of 58 个事件)
ALYac Gen:Variant.Ulises.581
APEX Malicious
AVG Win32:Trojan-gen
Acronis suspicious
Ad-Aware Gen:Variant.Ulises.581
AhnLab-V3 Win-Trojan/Rifdoor.22828
Arcabit Trojan.Ulises.581
Avast Win32:Trojan-gen
Avira HEUR/AGEN.1017405
BitDefender Gen:Variant.Ulises.581
BitDefenderTheta Gen:NN.ZexaF.34100.bu1@aWKiL9oi
Bkav W32.AIDetectVM.malware
CAT-QuickHeal Trojan.MauvaiseRI.S5243312
Comodo TrojWare.Win32.Agent.RTC@7537gm
CrowdStrike win/malicious_confidence_100% (D)
Cybereason malicious.27c782
Cylance Unsafe
Cyren W32/S-400ff18a!Eldorado
DrWeb Trojan.DownLoader27.23099
ESET-NOD32 a variant of Win32/Agent.RTC
Emsisoft Gen:Variant.Ulises.581 (B)
Endgame malicious (high confidence)
F-Prot W32/S-400ff18a!Eldorado
F-Secure Heuristic.HEUR/AGEN.1017405
FireEye Generic.mg.def84e6cb456f8a2
Fortinet W32/Agent.RTC!tr
GData Gen:Variant.Ulises.581
Ikarus Trojan.Win32.Agent
Invincea heuristic
Jiangmin Trojan.Generic.ohga
K7AntiVirus Trojan ( 004e0a9b1 )
K7GW Trojan ( 004e0a9b1 )
Kaspersky Trojan-Downloader.Win32.Upatre.iekr
MAX malware (ai score=88)
Malwarebytes Trojan.SelfDelete
MaxSecure Trojan.Malware.121218.susgen
McAfee GenericRXAY-WR!DEF84E6CB456
McAfee-GW-Edition GenericRXAY-WR!DEF84E6CB456
MicroWorld-eScan Gen:Variant.Ulises.581
Microsoft Trojan:Win32/Wacatac.D!ml
NANO-Antivirus Trojan.Win32.Dwn.eamuzd
Panda Trj/Genetic.gen
Qihoo-360 HEUR/QVM20.1.1D81.Malware.Gen
Rising Downloader.Upatre!8.B5 (RDMK:cmRtazocBmt6ft/iokmMR3n2sDgO)
SUPERAntiSpyware Trojan.Agent/Gen-Downloader
Sangfor Malware
SentinelOne DFI - Suspicious PE
Sophos Troj/Agent-BDYX
Symantec ML.Attribute.HighConfidence
Tencent Malware.Win32.Gencirc.10b900d1
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2016-02-19 14:32:58

PE Imphash

6e422d9571eebc39b9447b608be77f42

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
.text 0x00001000 0x000020ce 0x00002200 6.205482195281136
.rdata 0x00004000 0x00000910 0x00000a00 5.399440088808499
.data 0x00005000 0x00000444 0x00000200 0.46003030617738494
.CRT 0x00006000 0x00000004 0x00000200 0.0
.rsrc 0x00007000 0x00000bf4 0x00000c00 3.903831608152358

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x00007130 0x00000568 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x00007698 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_VERSION 0x000076ac 0x000002e8 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_MANIFEST 0x00007994 0x0000025f LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library SHLWAPI.dll:
• 0x4040b8 StrToIntA
• 0x4040bc StrStrA
• 0x4040c0 StrChrA
Library WS2_32.dll:
• 0x4040d8 htons
• 0x4040dc setsockopt
• 0x4040e0 WSAIoctl
• 0x4040e4 recv
• 0x4040e8 WSAGetLastError
• 0x4040ec closesocket
• 0x4040f0 gethostbyname
• 0x4040f4 send
• 0x4040f8 connect
• 0x4040fc WSAStartup
• 0x404100 socket
• 0x404104 gethostname
• 0x404108 WSACleanup
Library WININET.dll:
• 0x4040d0 DeleteUrlCacheEntry
Library ADVAPI32.dll:
• 0x404000 GetUserNameA
• 0x404004 RegOpenKeyExA
• 0x404008 RegCreateKeyA
• 0x40400c RegQueryValueExA
• 0x404010 RegSetValueExA
• 0x404014 RegCloseKey
Library urlmon.dll:
Library KERNEL32.dll:
• 0x404024 CreateMutexA
• 0x404028 GetModuleFileNameA
• 0x40402c CreatePipe
• 0x404030 OpenMutexA
• 0x404034 CloseHandle
• 0x404038 GetLastError
• 0x40403c GetVersionExA
• 0x404040 CreateDirectoryA
• 0x404044 lstrcatA
• 0x404048 ReadFile
• 0x40404c TerminateProcess
• 0x404050 GetTempPathA
• 0x404054 lstrcpyA
• 0x40405c WinExec
• 0x404060 GetLocalTime
• 0x404064 HeapAlloc
• 0x404068 CreateProcessA
• 0x40406c GetExitCodeProcess
• 0x404070 ExitProcess
• 0x404074 GetComputerNameA
• 0x404078 CreateFileA
• 0x40407c GetFileSize
• 0x404080 lstrcmpA
• 0x404084 lstrlenA
• 0x40408c HeapFree
• 0x404090 WaitForSingleObject
• 0x404094 GetTickCount
• 0x404098 GetProcessHeap
• 0x40409c WriteFile
• 0x4040a0 GetCommandLineA
• 0x4040a4 GlobalAlloc
• 0x4040a8 Sleep
Library SHELL32.dll:
• 0x4040b0 ShellExecuteA
Library USER32.dll:
• 0x4040c8 wsprintfA
Library IPHLPAPI.DLL:
• 0x40401c GetAdaptersInfo
L!This program cannot be run in DOS mode.
FVFVFV)3VEV)
VEVO>VUVFV{V)
VGV)7VGV)0VGVRichFV
`.rdata
@.data
@.rsrc
jD3MVQ
EEEEED
SSURVS
MQRPWh
3_^[]U
_^[]3_^[]U
QPhdA@
[^]U$VWP
u/PPURPPj
_^]UQSVW
|_^[]U
GMuu[_^]
uUhV5T@@
uMQURh
9}tNhB@
v548P@
t158T@
FF58T@
SVEPQE
URVV5@@
VWX\`:
[]_^3[]Up
up5T@@
uQhXC@
t]U=@@
[_3^]U
EPMQURE
3EEEEE3
fM3UREPSSSj
MSURh
M;t6;t2E
EPQUR$PDhxA@
sE-(P@
@<RD,P$xS@$QM
EQRPMQRhA@
Eu hHB@
PQ 5T@@
EPQh0B@
EuChHB@
PQh0B@
E@PQh0B@
P!h4B@
@u+Q@U
_^[]USV5<T@
W;58T@
PF;58T@
SVWD$ Ph
V_^[]U
_^uhC@
DDDDDDDDDDDDDD
vwwxwwkw
|0%||I|
|,|-|B$|
wHxw*\w
f+q>qDqZaq
q9qOqBqj@qMfq;qPq(Dq
\@I[XN]JSBfl}`|`i{SXfak`x|/A[SLz}}ja{Yj}|f`aS
_}`kzl{Anbj
L\KYj}|f`a
sec.exe
L5Sxfak`x|S|v|{jb<=Slbk!jwj
%s /c %s
_]@LJ\\JK/N[
CMD:%s %s %d/%d/%d %d:%d:%d
+fa{j}ync
Fa{j}ync/f|/|j{/{`
%s %d min
+k`xac`nkjwjl
K`xac`nk/infcz}j
K`xac`nk/|zllj||
Jwjlz{f`a/infcz}j
Jwjlz{f`a/|zllj||
+k`xac`nk
\`i{xn}jSBfl}`|`i{SXfak`x|SLz}}ja{Yj}|f`aS]za
L5S_}`h}nbKn{nSFaf{jlg
L5S_}`h}nbKn{nSFaf{jlgSFaf{jlg!jwj
L5S_}`h}nb/Ifcj|SL`bb`a/Ifcj|SFaf{jlg
L5S_}`h}nb/Ifcj|SL`bb`a/Ifcj|SFaf{jlgSFaf{jlg!jwj
"%s" /run
/c del /q "%s" >> NUL
l5Sxfak`x|S|v|{jb<=Slbk!jwj
MUTEX394039_4830023
StrStrA
StrToIntA
StrChrA
SHLWAPI.dll
WSAIoctl
WS2_32.dll
DeleteUrlCacheEntry
WININET.dll
RegSetValueExA
RegQueryValueExA
RegCreateKeyA
RegOpenKeyExA
GetUserNameA
RegCloseKey
ADVAPI32.dll
URLOpenBlockingStreamA
urlmon.dll
ExitProcess
GetComputerNameA
CreateFileA
GetFileSize
lstrcmpA
lstrlenA
HeapAlloc
HeapFree
WaitForSingleObject
GetTickCount
GetProcessHeap
WriteFile
GetCommandLineA
GlobalAlloc
GetExitCodeProcess
CreateProcessA
TerminateProcess
ReadFile
lstrcatA
CreateDirectoryA
SetCurrentDirectoryA
GetLastError
GetLocalTime
OpenMutexA
CreatePipe
GetModuleFileNameA
CreateMutexA
GetVersionExA
WinExec
CloseHandle
GetTempPathA
lstrcpyA
KERNEL32.dll
ShellExecuteA
SHELL32.dll
wsprintfA
USER32.dll
GetAdaptersInfo
IPHLPAPI.DLL
IsProcessorFeaturePresent
165.194.123.67
3333333333333333333
0.10/13333320
0...10/133332+0
0...10/133332(!
10/133332
-0//133332*
)$0//1133332
11133332
11333322220
222222333333333333333333333233333333%333333233333333"3333332
333333
33333332
33333333333333333333
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><application xmlns="urn:schemas-microsoft-com:asm.v3"><windowsSettings><ms_windowsSettings:dpiAware xmlns:ms_windowsSettings="http://schemas.microsoft.com/SMI/2005/WindowsSettings" xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</ms_windowsSettings:dpiAware></windowsSettings></application></assembly>PPADDINGXXPAD
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Initech (C) Co, Ltd
FileDescription
Initech Client
FileVersion
5.5.5.5
InternalName
Initech Client
LegalCopyright
Copyright (C) 2016
OriginalFilename
Initech Client
ProductName
Initech Client
ProductVersion
1.0.0.24
VarFileInfo
Translation

DNS

Name Response Post-Analysis Lookup
dns.msftncsi.com A 131.107.255.255 131.107.255.255
dns.msftncsi.com AAAA fd3e:4f5a:5b81::1 131.107.255.255

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.