1.4
低危

30a97deae099efca45eb9567e1aaef6ad7f0cab7b2513b80672afe6e1cf67189

e1e69586ac8acee324d878661dbf8dff.exe

分析耗时

2s

最近分析

文件大小

461.9KB
静态报毒 动态报毒 100% 3FI1GS AI SCORE=80 AIDETECTVM AKYO BEVV CLASSIC CM2@AW@NVLEI CONFIDENCE EHLS GENERICKD GENETIC GOZI GRAYWARE HDWA HIGH CONFIDENCE HLCJNV JQROW KRYPTIK MALCERT MALICIOUS PE MALWARE1 MALWARE@#1WFZH18MJP5ZV QVM20 R + TROJ R03BC0DJT20 R339508 SCORE STATIC AI TROJANBANKER TROJANX UNSAFE URSNIF URSNIFDROPPER VVKL WACATAC ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee Packed-GCB!E1E69586AC8A 20201211 6.0.6.653
Alibaba TrojanBanker:Win32/Kryptik.20f51ef1 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:TrojanX-gen [Trj] 20201210 21.1.5827.0
Tencent Win32.Trojan-banker.Gozi.Akyo 20201211 1.0.0.1
Kingsoft 20201211 2017.9.26.565
CrowdStrike win/malicious_confidence_100% (W) 20190702 1.0
行为判定
动态指标
网络通信
File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.33967952
FireEye Generic.mg.e1e69586ac8acee3
McAfee Packed-GCB!E1E69586AC8A
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Riskware ( 0040eff71 )
Alibaba TrojanBanker:Win32/Kryptik.20f51ef1
K7GW Riskware ( 0040eff71 )
Arcabit Trojan.Generic.D2064F50
Cyren W32/Trojan.VVKL-7907
Symantec Packed.Generic.459
APEX Malicious
Avast Win32:TrojanX-gen [Trj]
Kaspersky HEUR:Trojan-Banker.Win32.Gozi.pef
BitDefender Trojan.GenericKD.33967952
NANO-Antivirus Trojan.Win32.Gozi.hlcjnv
Paloalto generic.ml
Tencent Win32.Trojan-banker.Gozi.Akyo
Ad-Aware Trojan.GenericKD.33967952
Sophos Mal/Generic-R + Troj/Agent-BEVV
Comodo Malware@#1wfzh18mjp5zv
F-Secure Trojan.TR/AD.UrsnifDropper.jqrow
DrWeb Trojan.Gozi.690
Zillya Trojan.Gozi.Win32.2840
TrendMicro TROJ_GEN.R03BC0DJT20
McAfee-GW-Edition BehavesLike.Win32.Generic.gt
Emsisoft MalCert.A (A)
Ikarus Trojan.Win32.Crypt
Jiangmin Trojan.Banker.Gozi.aoy
Avira TR/AD.UrsnifDropper.jqrow
Antiy-AVL GrayWare/Win32.Kryptik.ehls
Gridinsoft Trojan.Win32.Kryptik.ba
Microsoft Trojan:Win32/Gozi.RA!MTB
AegisLab Trojan.Multi.Generic.4!c
ZoneAlarm HEUR:Trojan-Banker.Win32.Gozi.pef
GData Trojan.GenericKD.33967952
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Ursnif.R339508
BitDefenderTheta Gen:NN.ZexaF.34670.Cm2@aW@Nvlei
ALYac Trojan.GenericKD.33967952
MAX malware (ai score=80)
VBA32 Trojan.Wacatac
Malwarebytes Trojan.Ursnif
ESET-NOD32 a variant of Win32/Kryptik.HDWA
TrendMicro-HouseCall TROJ_GEN.R03BC0DJT20
Rising Trojan.Kryptik!1.C778 (CLASSIC)
Yandex Trojan.Kryptik!3Fi1gS/gq/I
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-06-05 00:49:55

Imports

Library KERNEL32.dll:
0x470b60 CloseHandle
0x470b64 lstrcpyA
0x470b68 lstrcatA
0x470b6c lstrlenA
0x470b70 GetModuleFileNameA
0x470b7c SearchPathA
0x470b80 GetFileAttributesA
0x470b84 GetLastError
0x470b88 CopyFileA
0x470b8c GetFileSize
0x470b90 LoadLibraryA
0x470b94 lstrcmpA
0x470b98 lstrcpynA
0x470b9c DeleteFileA
0x470ba0 TerminateProcess
0x470ba4 WaitForSingleObject
0x470ba8 GetExitCodeProcess
0x470bac CreateProcessA
0x470bb0 GetVersionExA
0x470bb4 GetModuleHandleA
0x470bb8 GetStartupInfoA
0x470bbc CreateFileA
0x470bc0 GetShortPathNameA
0x470bc4 GetTempFileNameA
0x470bc8 GetTempPathA
0x470bcc CreateDirectoryA
0x470bd0 GetProcAddress
0x470bd4 FreeLibrary
0x470bdc MoveFileExA
0x470be4 IsDebuggerPresent
0x470bec HeapDestroy
0x470bf0 SetFileTime
0x470bf4 _llseek
0x470bfc CreateHardLinkA
0x470c00 WriteProcessMemory
0x470c08 QueueUserAPC
0x470c0c GetOEMCP
0x470c10 HeapCreate
0x470c14 MoveFileA
0x470c1c SetWaitableTimer
0x470c24 Sleep
0x470c28 SetFilePointerEx
0x470c2c Process32Next
0x470c30 SetConsoleMode
0x470c34 VirtualAlloc
Library USER32.dll:
0x470c3c wsprintfA
0x470c40 MessageBoxA
0x470c44 LoadIconA
0x470c48 GetSystemMetrics
0x470c4c EnableWindow
0x470c50 IsIconic
0x470c54 GetClientRect
0x470c58 SendMessageA
0x470c5c DrawIcon
0x470c60 PackDDElParam
0x470c64 OpenIcon
0x470c68 OemToCharW
0x470c6c EditWndProc
0x470c70 CallWindowProcA
0x470c74 IntersectRect
0x470c78 EnumWindowStationsA
0x470c7c ToUnicode
0x470c80 EnumPropsW
0x470c84 LoadIconW
0x470c88 GetThreadDesktop
0x470c8c GetDialogBaseUnits
0x470c90 LoadCursorFromFileA
0x470c94 CharUpperW
0x470c98 DestroyCursor
0x470c9c VkKeyScanA
0x470ca0 DestroyMenu
0x470ca4 CharUpperA
0x470ca8 DrawMenuBar
0x470cac LoadCursorFromFileW
0x470cb0 GetListBoxInfo
0x470cb4 GetMenuItemCount
0x470cb8 IsWindow
0x470cbc WindowFromDC
Library GDI32.dll:
0x470cc4 GetEnhMetaFileA
0x470cc8 CreateMetaFileA
0x470ccc SwapBuffers
0x470cd0 GetSystemPaletteUse
0x470cd4 FillPath
0x470cd8 GetMapMode
0x470cdc CloseMetaFile
0x470ce0 UpdateColors
0x470ce4 CancelDC
0x470ce8 GetTextAlign
0x470cec GetLayout
0x470cf0 RealizePalette
Library ADVAPI32.dll:
0x470cf8 RegSetValueExA
0x470cfc RegEnumKeyA
0x470d00 RegOpenKeyExA
0x470d04 RegCloseKey
0x470d08 RegQueryValueExA
0x470d0c RegCreateKeyExA
0x470d10 RegQueryValueExW
0x470d14 GetUserNameA
Library SHELL32.dll:
0x470d1c ShellExecuteExA
0x470d20 SHGetFolderPathA
0x470d28 ShellExecuteA
Library ole32.dll:
0x470d30 CoCreateInstance
0x470d34 CLSIDFromProgID

Hosts

No hosts contacted.

DNS

No domains contacted.

TCP

No TCP connections recorded.

UDP

No UDP connections recorded.

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.