SmartHawk

5.6

高危

26 个模型检测该样本为恶意！

重新分析

下载样本

2c9a56116d34514c98f71a77cd80ab3b32d6523b2d7aa9b89b6e4f5c1cd8a8df

e3c635d13a890ff7af8a6e2b2e91ed38.exe

分析耗时

95s

最近分析

文件大小

6.9MB

静态报毒动态报毒 100% ARTEMIS ATTRIBUTE BROPASS CONFIDENCE FILECODER FILELOCKER FILEREPMALWARE HIGH CONFIDENCE HIGHCONFIDENCE HUPIGON KRYPTIK MALWARE@#1GDME3A384L3J PYTHON SCORE STATIC AI SUSPICIOUS PE TOOL TRQF UNSAFE WACATAC 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!E3C635D13A89	20201114	6.0.6.653
Alibaba	Trojan:Python/Filecoder.0c1aca79	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast		20201114	20.10.5736.0
Kingsoft		20201114	2013.8.14.323
Tencent		20201114	1.0.0.1
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619959261.20075 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.gfids

Creates executable files on the filesystem (6 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\python37.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\libssl-1_1.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\VCRUNTIME140.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tk86t.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\libcrypto-1_1.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl86t.dll

Drops an executable to the user AppData folder (15 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\select.pyd
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\unicodedata.pyd
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\pyexpat.pyd
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tk86t.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\_tkinter.pyd
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\_ssl.pyd
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl86t.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\_hashlib.pyd
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\libcrypto-1_1.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\libssl-1_1.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\_bz2.pyd
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\_socket.pyd
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\_lzma.pyd
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\VCRUNTIME140.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\python37.dll

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.517048639811873

section

{'size_of_data': '0x0000f000', 'virtual_address': '0x0003c000', 'entropy': 7.517048639811873, 'name': '.rsrc', 'virtual_size': '0x0000eec8'}

description

A section with a high entropy has been found

entropy

0.25210084033613445

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Creates known Hupigon files, registry keys and/or mutexes (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\QQQQ.exe.manifest

Appends a known multi-family ransomware file extension to files that have been encrypted (50 out of 78 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\macDingbats.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\iso8859-15.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\iso8859-9.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\gb1988.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\gb2312.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp1255.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp860.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp775.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp437.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\iso2022.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp861.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp936.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\ksc5601.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp1254.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp949.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\iso8859-3.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\iso8859-7.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\jis0201.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\macJapan.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\macRoman.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\ascii.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\macTurkish.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\dingbats.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\big5.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\ebcdic.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp863.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\symbol.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp1250.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp1251.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\koi8-r.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\iso8859-14.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp852.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp866.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp865.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\macCentEuro.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\shiftjis.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\iso8859-1.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp857.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp869.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp1257.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\gb12345.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\iso8859-10.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp932.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\iso8859-4.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\iso8859-5.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\euc-kr.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\iso8859-8.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp850.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\macIceland.enc
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_MEI1962\tcl\encoding\cp1253.enc

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 个事件)

Elastic	malicious (high confidence)
McAfee	Artemis!E3C635D13A89
Sangfor	Malware
Alibaba	Trojan:Python/Filecoder.0c1aca79
Cybereason	malicious.149af9
Invincea	Mal/Generic-S
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Comodo	Malware@#1gdme3a384l3j
Zillya	Tool.BroPass.Script.18
McAfee-GW-Edition	BehavesLike.Win32.Generic.vc
FireEye	Generic.mg.e3c635d13a890ff7
Sophos	Mal/Generic-S
Paloalto	generic.ml
Gridinsoft	Trojan.Win32.Kryptik.ko!s1
Microsoft	Trojan:Win32/Wacatac.C!ml
AegisLab	Trojan.Win32.Stealer.trqf
Cynet	Malicious (score: 100)
ALYac	Trojan.Ransom.Python
Malwarebytes	Ransom.FileLocker
ESET-NOD32	Python/Filecoder.EN
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Filecoder.EN!tr
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_100% (W)

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-01-05 20:16:35

Imports

Library USER32.dll:

• 0x420180 MessageBoxW

• 0x420184 MessageBoxA

Library KERNEL32.dll:

• 0x420008 GetLastError

• 0x42000c SetDllDirectoryW

• 0x420010 GetModuleFileNameW

• 0x420014 GetProcAddress

• 0x420018 GetCommandLineW

• 0x42001c GetEnvironmentVariableW

• 0x420020 SetEnvironmentVariableW

• 0x420024 ExpandEnvironmentStringsW

• 0x420028 GetTempPathW

• 0x42002c DecodePointer

• 0x420030 Sleep

• 0x420034 GetExitCodeProcess

• 0x420038 CreateProcessW

• 0x42003c GetStartupInfoW

• 0x420040 LoadLibraryExW

• 0x420044 CreateDirectoryW

• 0x420048 GetShortPathNameW

• 0x42004c FormatMessageW

• 0x420050 LoadLibraryA

• 0x420054 MultiByteToWideChar

• 0x420058 WideCharToMultiByte

• 0x42005c WaitForSingleObject

• 0x420060 CloseHandle

• 0x420064 SetEndOfFile

• 0x420068 HeapReAlloc

• 0x42006c UnhandledExceptionFilter

• 0x420070 SetUnhandledExceptionFilter

• 0x420074 GetCurrentProcess

• 0x420078 TerminateProcess

• 0x42007c IsProcessorFeaturePresent

• 0x420080 QueryPerformanceCounter

• 0x420084 GetCurrentProcessId

• 0x420088 GetCurrentThreadId

• 0x42008c GetSystemTimeAsFileTime

• 0x420090 InitializeSListHead

• 0x420094 IsDebuggerPresent

• 0x420098 GetModuleHandleW

• 0x42009c RtlUnwind

• 0x4200a0 SetLastError

• 0x4200a4 EnterCriticalSection

• 0x4200a8 LeaveCriticalSection

• 0x4200ac DeleteCriticalSection

• 0x4200b0 InitializeCriticalSectionAndSpinCount

• 0x4200b4 TlsAlloc

• 0x4200b8 TlsGetValue

• 0x4200bc TlsSetValue

• 0x4200c0 TlsFree

• 0x4200c4 FreeLibrary

• 0x4200c8 GetCommandLineA

• 0x4200cc ReadFile

• 0x4200d0 CreateFileW

• 0x4200d4 GetDriveTypeW

• 0x4200d8 GetFileType

• 0x4200dc RaiseException

• 0x4200e0 PeekNamedPipe

• 0x4200e4 SystemTimeToTzSpecificLocalTime

• 0x4200e8 FileTimeToSystemTime

• 0x4200ec GetFullPathNameW

• 0x4200f0 GetFullPathNameA

• 0x4200f4 RemoveDirectoryW

• 0x4200f8 FindClose

• 0x4200fc FindFirstFileExW

• 0x420100 FindNextFileW

• 0x420104 SetStdHandle

• 0x420108 SetConsoleCtrlHandler

• 0x42010c DeleteFileW

• 0x420110 GetStdHandle

• 0x420114 WriteFile

• 0x420118 ExitProcess

• 0x42011c GetModuleHandleExW

• 0x420120 GetACP

• 0x420124 HeapFree

• 0x420128 HeapAlloc

• 0x42012c GetConsoleMode

• 0x420130 ReadConsoleW

• 0x420134 SetFilePointerEx

• 0x420138 GetConsoleCP

• 0x42013c CompareStringW

• 0x420140 LCMapStringW

• 0x420144 GetCurrentDirectoryW

• 0x420148 FlushFileBuffers

• 0x42014c SetEnvironmentVariableA

• 0x420150 GetFileAttributesExW

• 0x420154 IsValidCodePage

• 0x420158 GetOEMCP

• 0x42015c GetCPInfo

• 0x420160 GetEnvironmentStringsW

• 0x420164 FreeEnvironmentStringsW

• 0x420168 GetStringTypeW

• 0x42016c GetProcessHeap

• 0x420170 WriteConsoleW

• 0x420174 GetTimeZoneInformation

• 0x420178 HeapSize

Library ADVAPI32.dll:

• 0x420000 ConvertStringSecurityDescriptorToSecurityDescriptorW

Library WS2_32.dll:

• 0x42018c ntohl

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.