1.1
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.66
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Small-NRY [Trj] | 20191020 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Inject.bm | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20191020 | 2013.8.14.323 |
| McAfee | Downloader-FQD!E0CEE16792F0 | 20191020 | 6.0.6.653 |
| Tencent | None | 20191020 | 1.0.0.1 |
静态指标
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(3 个事件)
| section | {'name': '.text', 'virtual_address': '0x00001000', 'virtual_size': '0x00001128', 'size_of_data': '0x00001200', 'entropy': 7.538826109000029} | entropy | 7.538826109000029 | description | 发现高熵的节 | |||||||||
| section | {'name': '.rsrc', 'virtual_address': '0x00005000', 'virtual_size': '0x000032c4', 'size_of_data': '0x00003400', 'entropy': 7.824647550277942} | entropy | 7.824647550277942 | description | 发现高熵的节 | |||||||||
| entropy | 0.8974358974358975 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 59 个反病毒引擎识别为恶意
(50 out of 59 个事件)
| ALYac | Gen:Variant.Ulise.5059 |
| APEX | Malicious |
| AVG | Win32:Small-NRY [Trj] |
| Acronis | suspicious |
| Ad-Aware | Gen:Variant.Ulise.5059 |
| AhnLab-V3 | Backdoor/Win32.CSon.R885 |
| Antiy-AVL | Trojan/Win32.Injector.qis |
| Arcabit | Trojan.Ulise.D13C3 |
| Avast | Win32:Small-NRY [Trj] |
| Avira | TR/Dropper.Gen |
| Baidu | Win32.Trojan.Inject.bm |
| BitDefender | Gen:Variant.Ulise.5059 |
| Bkav | W32.FamVT.AdojNHc.Trojan |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| ClamAV | Win.Trojan.Rubinurd-67 |
| Comodo | TrojWare.Win32.Downloader.ROWQ@4zfm8o |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.792f03 |
| Cylance | Unsafe |
| Cyren | W32/Simbot.A.gen!Eldorado |
| DrWeb | Trojan.DownLoad2.36100 |
| ESET-NOD32 | Win32/Injector.QIS |
| Emsisoft | Gen:Variant.Ulise.5059 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Simbot.A.gen!Eldorado |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.e0cee16792f0332e |
| Fortinet | W32/Injector.QIS!tr |
| GData | Gen:Variant.Ulise.5059 |
| Ikarus | Virus.Win32.CeeInject |
| Invincea | heuristic |
| Jiangmin | Trojan/Genome.akxd |
| K7AntiVirus | Trojan-Downloader ( 0040f54b1 ) |
| K7GW | Trojan ( 004be8a21 ) |
| Kaspersky | HEUR:Trojan.Win32.Miancha.gen |
| MAX | malware (ai score=87) |
| Malwarebytes | Backdoor.Simbot |
| McAfee | Downloader-FQD!E0CEE16792F0 |
| McAfee-GW-Edition | BehavesLike.Win32.Backdoor.mc |
| MicroWorld-eScan | Gen:Variant.Ulise.5059 |
| Microsoft | Backdoor:Win32/Simbot!rfn |
| NANO-Antivirus | Trojan.Win32.TrjGen.cojbpd |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.AD0F.Malware.Gen |
| Rising | Trojan.Inejctor!1.A7C6 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Downloader |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/DwnLdr-MDK |
| Symantec | Downloader |
| Trapmine | malicious.high.ml.score |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2010-11-06 11:06:34
PE Imphash
f0c0a52023ddf031f7d5cc1b2b52c624
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00001128 | 0x00001200 | 7.538826109000029 |
| .rdata | 0x00003000 | 0x00000415 | 0x00000600 | 3.629375823339467 |
| .data | 0x00004000 | 0x0000039f | 0x00000200 | 3.656578640673414 |
| .rsrc | 0x00005000 | 0x000032c4 | 0x00003400 | 7.824647550277942 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_RCDATA | 0x000050b4 | 0x00002e00 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x00007eb4 | 0x00000410 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.dll:
• 0x403010 EnterCriticalSection
• 0x403014 VirtualProtect
• 0x403018 InitializeCriticalSection
• 0x40301c GetModuleHandleA
• 0x403020 HeapAlloc
• 0x403024 GetProcessHeap
• 0x403028 TerminateProcess
• 0x40302c VirtualAllocEx
• 0x403030 HeapFree
• 0x403034 VirtualAlloc
• 0x403038 lstrlenA
• 0x40303c GetLastError
• 0x403040 LockResource
• 0x403044 lstrcpyA
• 0x403048 SizeofResource
• 0x40304c FindResourceA
• 0x403050 WritePrivateProfileStringA
• 0x403054 GetTempPathA
• 0x403058 CloseHandle
• 0x40305c WriteFile
• 0x403060 SetFilePointer
• 0x403064 ExitProcess
• 0x403068 ReadFile
• 0x40306c GetFileSize
• 0x403070 CreateFileA
• 0x403074 CopyFileA
• 0x403078 GetModuleFileNameA
• 0x40307c lstrcatA
• 0x403080 GetProcAddress
• 0x403084 LoadResource
• 0x403088 LeaveCriticalSection
Library ADVAPI32.dll:
• 0x403000 CryptGenRandom
• 0x403004 CryptReleaseContext
• 0x403008 CryptAcquireContextA
Exports
| Ordinal | Address | Name |
|---|---|---|
| 1 | 0x404150 | szFile |
L!This program cannot be run in DOS
iiirgih
miRichi
.rdata
@.data
H<EXB@
:F$N8't@#,
SX)fx6R
fD0bK[
|@ksoGwW]-
.o6LP+l<
ZBG8g\ c
3C.G$Ay(
yxGmsF]f
Xa ^5w-ki
%\q%t91k6G:Rn~s
1bQq6|
.:xH&qG]
8pkCgM&
C$Vh]*~
D]rZ%$tQN
5-~Ur!
FV8!_ /X
JiTbeW
W4[GC9{[dN}
1H"6YU
n\-@:h
w_'=n 6!}Z
![7} wJ`
H,@(V&BMvW
muUSK:Ky=aK|
`mn9B.gV8eGA*][9([?
}d,K^~
R7[rc+
!m 93*
q7`fX{>
k{U6~l
m:&GH#
f}a~p%-fUl$
VW=80@
F;r[B@
0\RlRR#DO
,"fb=y
0_kEWU)
]N(zFC
a"+|4;
4~`6m,
Iy2yAUJ
P"dbGK
*R-wZO)C
4O1-A`
`+L&U^ j4
l0!sJD
#yFie`
w4z6ef4\W
O>cJZ1Lna
1CjhU09evD#.
_Y.l>3b
5f5baL\k5b
&9}(O(Y
7$ECycov
A%ohXL;
$X.v9L
f{+7H=(Z|7(
oSEva}]B219I8V^Hj
A(;r3_^[
EE~cSVu
|_^[UWVu
DDDDDDDDDDDDDD
LeaveCriticalSection
GetProcAddress
lstrcatA
lstrcpyA
EnterCriticalSection
VirtualProtect
InitializeCriticalSection
GetModuleHandleA
HeapAlloc
GetProcessHeap
TerminateProcess
VirtualAllocEx
HeapFree
VirtualAlloc
lstrlenA
GetLastError
LockResource
LoadResource
SizeofResource
FindResourceA
WritePrivateProfileStringA
GetTempPathA
CloseHandle
WriteFile
SetFilePointer
ExitProcess
ReadFile
GetFileSize
CreateFileA
CopyFileA
GetModuleFileNameA
KERNEL32.dll
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
ADVAPI32.dll
roudanx.exe
szFile
szFile
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
kernel32
ZwUnmapViewOfSection
4$@2.dat
rwbinru/dyd
RT_RCDATA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
av$M\0%
zCYS9qFfN>}|Pt
zIT4/#yVf7G{
pGO|/E#8_p
-?@y2&nZq
ecmu+Cj1Z
Xg>r8IGvp
boK@#F-~
2(Aq#Aw
>Ph Z
>gHDQ4& k
\n)0[4
PkCk'k}3;}
s(x.t"
|*HM Zq
fEU57F
%bvj'hDqC.Mj
P_FQ.`
rPLMQo
jDV1D{
yioo9YvIl|
HYN2RS
{@OC.O_Q
KA1CH;
{NnahOp
}{!#-7l
Fu4sv(
AT3Ng?
=8*W$VQ
U]$/|o
.t8;Hp,E
Ce~xwVi7TE[
@,.Z[D7>+1"N5:U
j-)&N16
(W8$&Bk8P
ACN{-u
ptR5u\
s+F~,2033]9-_"z@WS.
\2u_M;b
E |jL>PV
R(wa'#(m
4+Ww &t:,
n`t?Pel'#l
\%\ ATC
'xxWRU)
xAVkLS
e`/rpr
22V/!)d
q+<67b %W
-$/<5jy
/'A388F
}DrQ/PNXm
S!EXhCL
T TauNha+S)j
;[g;*Su
zE!L\%|
5o"e(z
RQ> f}i>W<[
<ezE)g!
9*_{p.
qkuh/Tjv
wZ|r.zaz 6~
*Xdt Sr
z9s3 \u?v!
)sE3qca
u{UL9#?
hF>!*DE
X{|Bf`A"!A?
Ee_Sy[n6iC
*1919!
_Bc lG)
!EMBe[WS
-TwjUG;c[{I
-K??ga^
j:,?@S
xE>L2O
|D.0P/
3KmyY_I?|hF
4t=$byb
p$q;M aa>mc0oj.:
:qD3Oa6
P#+C[M(
Sz=;nqO
Ug \Y2
Dda~=P
U}%p:lZ>S$
4-Z"n>F T
j?jKs~n
PN<D{=a
ApG!XJIu_r
SbC5>{c
d?1fLpZinq[>:FrlVetfbKYc
?=fJ7i)s@
@8WkQ=<`&p
"y\gc!z
RbG-8]v
^Z)>Jn bT6g{JUB
q8l{}Dzu2y
!l[e1^H
#tU GOV9F[z
PI&z$y9 b
%uDs~tS?7
DGgXC"v
8&Dk|C5
c\K5*4P
:Z0$ q/
(n?9F8
A3?yA%
xfHxrvPgok9[\@[
Vv,efj]
hp,&(-KFF
{>r<m?j?
]3)(+"Ow
O+jP+ 02P
~IS>>(
uM{CC,kip"
=j@k+~
h%b5rI?e
zj@[:5+C
"9j@D&{F*]M<.i
39Bj'p
I9xj:h
oTJPEIOD<8
Sq/j`^Vd@6hQ{/
sjv$]^
<ltRIB`_3
g5Ie)
9`&bw}
GDY's_@
% ""8&
#k4Kj(q3mr(``D
|M*^&pM$6xR!
tky(z
Qg/j!Cy
S?'dHG
PI/9~J::T
:qV"Ko
yPP<J
?cMm;d6
X,z;uG
7Vu[N$
3Z'CGd}IOF
V2-wvV(
,V-1l?k2Xn
Ar`V,d?
rYRs~Rf\pm)
-H4N=rj:
l H4O7
ou5TL]c
?~nC^
Hx}cw+
qQkMVtUs /#`5
~Ag# pkq0
7Vj\ZI BZ
sKWpbD[i
T!QfU8!n1 0+O)kn2
p"xUeLL
Dz\XN9
aC&@'{
{xZc7qN1Id&ofb AW!~b|^
w%)We/3SaX
S]Uafcv eO
~|xkL`99_&-
b^WALm-TOm
M^lAI!E^\1
'[&!"[IIe
=lwJL!-
Dd=f09o(>
IH<>{g
I9K|o6tu
L4h;H@d
KKO=gggX,DA}}_-G
\I)v}L
7wv"^n5e
)@wSd1
i83Iba^G
C6V@R+EG
"Us X!
%L3w*U
T=?o-ec)
FLN\iiw
db)\]&a@$&f0
(^o-Opq
|AHd@-
o/,NR*3
-4'ds1W7
b`k=PR#GLb
7$3Ykx
i4u 5.
:?I29p
CvaJ6ycsX
1|:*RJ
xb5)D2jy;T
"hX ,hPy%
^$=}P#3Nqvo
"7CcKI
80qq_q
R\4A A$
*J-aU<=&Q&
[eqi!V]x
.rG,+f
N$zY+Zlq4#UQ
"gP386
0?wn o=*
2lk+a/B)wIHd
3&;y2cm
#vj5"l=
kG+VYxO
$$b5d:R-
&-X9A xhr
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
R T _ R C D A T A
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 b 0
C o m p a n y N a m e
A d o b e S y s t e m s , I n c .
F i l e D e s c r i p t i o n
A d o b e ? F l a s h ? P l a y e r I n s t a l l e r / U n i n s t a l l e r 1 0 . 1 r 5 3
F i l e V e r s i o n
1 0 , 1 , 5 3 , 6 4
I n t e r n a l N a m e
A d o b e ? F l a s h ? P l a y e r I n s t a l l e r / U n i n s t a l l e r 1 0 . 1
L e g a l C o p y r i g h t
C o p y r i g h t ? 1 9 9 6 - 2 0 1 0 A d o b e , I n c .
L e g a l T r a d e m a r k s
A d o b e ? F l a s h ? P l a y e r
O r i g i n a l F i l e n a m e
F l a s h U t i l . e x e
P r o d u c t N a m e
F l a s h ? P l a y e r I n s t a l l e r / U n i n s t a l l e r
P r o d u c t V e r s i o n
1 0 , 1 , 5 3 , 6 4
V a r F i l e I n f o
T r a n s l a t i o n
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.