2.8
中危

a17e79c5b8367db0e97a2d800ec7d079d3247007833c07f042e4859211853b6d

e5013b7ceebf0f425e9eb7cd2defc462.exe

分析耗时

90s

最近分析

文件大小

5.9MB
静态报毒 动态报毒 @T1@A8QZSVCO AI SCORE=83 AIDETECTVM BAMBARBIYA BANKERX BSYMEM CONFIDENCE CRYPTINJECT EHLS ELDORADO EMOTET ENCPK F1XVSVKMTUC FXRX GENCBL GENCIRC GENERICKDZ GENETIC GMYGG GRAYWARE HGBS HIGH CONFIDENCE HUVWLD INVALIDSIG KRYPTIK LMEB7E MALICIOUS PE MALWARE1 MALWARE@#33ISH32NI5ULK PINKSBOT QAKBOT QBOT QVM20 R + MAL R350943 SCORE THIAIBO UNSAFE WACATAC XBVHYFYG3LC ZEXAF 更多
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee W32/PinkSbot-HC!E5013B7CEEBF 20201022 6.0.6.653
Alibaba Trojan:Win32/CryptInject.abb926d8 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast Win32:BankerX-gen [Trj] 20201022 18.4.3895.0
Kingsoft 20201022 2013.8.14.323
Tencent Malware.Win32.Gencirc.10ce0379 20201022 1.0.0.1
CrowdStrike win/malicious_confidence_90% (W) 20190702 1.0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1620818758.316249
NtAllocateVirtualMemory
process_identifier: 1060
region_size: 507904
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x009f0000
success 0 0
Foreign language identified in PE resource (50 out of 55 个事件)
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_CURSOR language LANG_KOREAN offset 0x005b8cdc filetype data sublanguage SUBLANG_KOREAN size 0x00000134
name RT_BITMAP language LANG_KOREAN offset 0x005b8ec8 filetype data sublanguage SUBLANG_KOREAN size 0x00000144
name RT_BITMAP language LANG_KOREAN offset 0x005b8ec8 filetype data sublanguage SUBLANG_KOREAN size 0x00000144
name RT_ICON language LANG_KOREAN offset 0x005de768 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_KOREAN size 0x00000568
name RT_ICON language LANG_KOREAN offset 0x005de768 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_KOREAN size 0x00000568
name RT_ICON language LANG_KOREAN offset 0x005de768 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_KOREAN size 0x00000568
name RT_ICON language LANG_KOREAN offset 0x005de768 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_KOREAN size 0x00000568
name RT_ICON language LANG_KOREAN offset 0x005de768 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_KOREAN size 0x00000568
name RT_ICON language LANG_KOREAN offset 0x005de768 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_KOREAN size 0x00000568
name RT_ICON language LANG_KOREAN offset 0x005de768 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_KOREAN size 0x00000568
name RT_ICON language LANG_KOREAN offset 0x005de768 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_KOREAN size 0x00000568
name RT_ICON language LANG_KOREAN offset 0x005de768 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_KOREAN size 0x00000568
name RT_ICON language LANG_KOREAN offset 0x005de768 filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_KOREAN size 0x00000568
name RT_STRING language LANG_KOREAN offset 0x005df85c filetype data sublanguage SUBLANG_KOREAN size 0x00000294
name RT_STRING language LANG_KOREAN offset 0x005df85c filetype data sublanguage SUBLANG_KOREAN size 0x00000294
name RT_STRING language LANG_KOREAN offset 0x005df85c filetype data sublanguage SUBLANG_KOREAN size 0x00000294
name RT_STRING language LANG_KOREAN offset 0x005df85c filetype data sublanguage SUBLANG_KOREAN size 0x00000294
name RT_STRING language LANG_KOREAN offset 0x005df85c filetype data sublanguage SUBLANG_KOREAN size 0x00000294
name RT_STRING language LANG_KOREAN offset 0x005df85c filetype data sublanguage SUBLANG_KOREAN size 0x00000294
name RT_STRING language LANG_KOREAN offset 0x005df85c filetype data sublanguage SUBLANG_KOREAN size 0x00000294
name RT_STRING language LANG_KOREAN offset 0x005df85c filetype data sublanguage SUBLANG_KOREAN size 0x00000294
name RT_STRING language LANG_KOREAN offset 0x005df85c filetype data sublanguage SUBLANG_KOREAN size 0x00000294
name RT_STRING language LANG_KOREAN offset 0x005df85c filetype data sublanguage SUBLANG_KOREAN size 0x00000294
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x005dff34 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x005dff34 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x005dff34 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x005dff34 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x005dff34 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x005dff34 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x005dff34 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x005dff34 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x005dff34 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x005dff34 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x005dff34 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN offset 0x005dff34 filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN size 0x00000014
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 个事件)
Bkav W32.AIDetectVM.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.70001
McAfee W32/PinkSbot-HC!E5013B7CEEBF
Cylance Unsafe
Zillya Trojan.Bsymem.Win32.1486
Sangfor Malware
K7AntiVirus Trojan ( 0056e1c71 )
Alibaba Trojan:Win32/CryptInject.abb926d8
K7GW Trojan ( 0056e2b11 )
Cybereason malicious.ceebf0
Arcabit Trojan.Generic.D11171
BitDefenderTheta Gen:NN.ZexaF.34570.@t1@a8qZsvcO
Cyren W32/RTM.A.gen!Eldorado
Symantec Packed.Generic.459
APEX Malicious
Avast Win32:BankerX-gen [Trj]
ClamAV Win.Packed.Qbot-9764493-0
Kaspersky HEUR:Trojan.Win32.Bsymem.pef
BitDefender Trojan.GenericKDZ.70001
NANO-Antivirus Trojan.Win32.QakBot.huvwld
Paloalto generic.ml
Rising Trojan.Qakbot!8.4EF9 (TFE:3:xbVHYFYg3lC)
Ad-Aware Trojan.GenericKDZ.70001
Sophos Mal/EncPk-APV
Comodo Malware@#33ish32ni5ulk
F-Secure Trojan.TR/Crypt.Agent.gmygg
DrWeb Trojan.QakBot.11
VIPRE Trojan.Win32.Generic!BT
Invincea Mal/Generic-R + Mal/EncPk-APV
McAfee-GW-Edition W32/PinkSbot-HC!E5013B7CEEBF
FireEye Generic.mg.e5013b7ceebf0f42
Emsisoft Trojan.GenericKDZ.70001 (B)
SentinelOne DFI - Malicious PE
Jiangmin TrojanDownloader.Agent.fxrx
eGambit PE.Heur.InvalidSig
Avira TR/Crypt.Agent.gmygg
Antiy-AVL GrayWare/Win32.Kryptik.ehls
Microsoft Trojan:Win32/CryptInject.DSB!MTB
ZoneAlarm HEUR:Trojan.Win32.Bsymem.pef
GData Win32.Trojan.PSE.LMEB7E
Cynet Malicious (score: 100)
AhnLab-V3 Trojan/Win32.Qakbot.R350943
Acronis suspicious
VBA32 Malware-Cryptor.Bambarbiya
ALYac Trojan.Agent.QakBot
MAX malware (ai score=83)
Malwarebytes Trojan.Qbot
ESET-NOD32 a variant of Win32/Kryptik.HGBS
TrendMicro-HouseCall Trojan.Win32.WACATAC.THIAIBO
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-09-10 23:33:58

Imports

Library KERNEL32.dll:
0x9b5758 LoadLibraryA
0x9b575c GetProcAddress
0x9b5760 Sleep
0x9b5764 VirtualAllocEx
0x9b5768 GetModuleHandleW
0x9b5774 WaitForSingleObject
0x9b5778 SetEvent
0x9b5780 SizeofResource
0x9b5784 MultiByteToWideChar
0x9b5788 lstrlenW
0x9b578c RaiseException
0x9b5790 GetLastError
0x9b5794 LoadLibraryExW
0x9b5798 lstrcmpiW
0x9b57a0 GetCurrentThreadId
0x9b57a4 CreateThread
0x9b57ac GetCurrentProcessId
0x9b57b0 GetTickCount
0x9b57b8 IsDebuggerPresent
0x9b57c4 LoadResource
0x9b57c8 FreeLibrary
0x9b57cc FindResourceW
0x9b57d0 GetCommandLineW
0x9b57d4 CloseHandle
0x9b57d8 GetModuleFileNameW
0x9b57dc OutputDebugStringW
0x9b57e0 CreateEventW
0x9b57e4 CreateProcessW
0x9b57e8 GetCurrentProcess
0x9b57ec TerminateProcess
0x9b57f0 GetStartupInfoW
0x9b5800 GetVersionExA
0x9b5804 GetThreadLocale
0x9b5808 GetLocaleInfoA
0x9b580c GetACP
0x9b5810 InterlockedExchange
0x9b5818 GetCommTimeouts
0x9b581c GetTapePosition
0x9b5820 EnumCalendarInfoA
0x9b5824 GetCommModemStatus
0x9b5828 GetComputerNameExA
0x9b582c CommConfigDialogA
0x9b5834 LocalSize
0x9b5838 GetWriteWatch
0x9b583c GetCPInfoExA
0x9b5840 FindVolumeClose
0x9b5844 PrepareTape
0x9b584c DeviceIoControl
0x9b5850 SleepEx
0x9b5858 ReadConsoleA
0x9b585c UnlockFile
0x9b5860 BackupSeek
0x9b5868 ExitProcess
0x9b586c GetTempFileNameW
0x9b5878 VirtualProtectEx
0x9b587c GlobalFindAtomW
0x9b5880 GetProcessHeap
0x9b5884 RtlUnwind
0x9b5888 HeapReAlloc
0x9b588c HeapSize
0x9b5890 GetStdHandle
0x9b5894 GetModuleFileNameA
0x9b58a8 GetCommandLineA
0x9b58ac SetHandleCount
0x9b58b0 GetFileType
0x9b58b4 GetStartupInfoA
0x9b58b8 HeapDestroy
0x9b58bc HeapCreate
0x9b58c0 VirtualFree
0x9b58c4 HeapAlloc
0x9b58c8 VirtualAlloc
0x9b58cc GetCPInfo
0x9b58d0 GetOEMCP
0x9b58d4 GetConsoleCP
0x9b58d8 GetConsoleMode
0x9b58dc GetStringTypeA
0x9b58e0 GetStringTypeW
0x9b58e4 LCMapStringA
0x9b58e8 LCMapStringW
0x9b58ec SetStdHandle
0x9b58f0 WriteConsoleA
0x9b58f4 GetConsoleOutputCP
0x9b58f8 WriteConsoleW
0x9b58fc CreateFileA
0x9b5900 HeapFree
0x9b5904 SetErrorMode
0x9b5908 lstrlenA
0x9b590c FlushFileBuffers
0x9b5910 SetFilePointer
0x9b5914 WriteFile
0x9b5918 ReadFile
0x9b591c TlsFree
0x9b5920 LocalReAlloc
0x9b5924 TlsSetValue
0x9b5928 TlsAlloc
0x9b592c GlobalHandle
0x9b5930 GlobalReAlloc
0x9b5934 TlsGetValue
0x9b5938 lstrcpyW
0x9b5940 PulseEvent
0x9b5944 OpenProcess
0x9b5948 OpenEventW
0x9b594c LoadLibraryW
0x9b5950 GetSystemTime
0x9b5954 GetFileTime
0x9b5958 FindFirstFileW
0x9b595c FindClose
0x9b5964 CreateFileW
Library USER32.dll:
0x9b596c LoadCursorA
0x9b5970 DispatchMessageW
0x9b5974 PostThreadMessageW
0x9b5978 CharUpperW
0x9b597c TranslateMessage
0x9b5980 CharNextW
0x9b5984 UnregisterClassA
0x9b5988 GetMessageW
0x9b598c SetDlgItemTextW
0x9b5990 DdeGetLastError
0x9b5994 GetKeyNameTextW
0x9b5998 SwitchDesktop
0x9b599c OpenDesktopA
0x9b59a0 EnumChildWindows
0x9b59a8 SetWinEventHook
0x9b59ac CharPrevW
0x9b59b0 SwapMouseButton
0x9b59b4 IMPGetIMEW
0x9b59b8 GetClassInfoExW
0x9b59bc GetMessagePos
0x9b59c0 CharLowerBuffA
0x9b59c4 RegisterClassExA
0x9b59c8 DestroyIcon
0x9b59cc SetCapture
0x9b59d4 GetDlgCtrlID
0x9b59d8 GetClassNameW
0x9b59dc GetClipboardData
0x9b59e0 InvertRect
0x9b59e4 MonitorFromPoint
0x9b59e8 GetClassInfoA
0x9b59ec EnumWindowStationsW
0x9b59f0 EnumDesktopsA
0x9b59f4 AppendMenuA
0x9b59f8 OffsetRect
Library GDI32.dll:
0x9b5a00 GetStockObject
0x9b5a04 GetEnhMetaFileBits
0x9b5a08 ResetDCW
0x9b5a0c TextOutA
0x9b5a10 CombineTransform
0x9b5a14 UnrealizeObject
0x9b5a18 ResizePalette
0x9b5a1c GdiStartDocEMF
0x9b5a20 GdiPlayJournal
0x9b5a24 GdiSetServerAttr
0x9b5a28 PolyPatBlt
0x9b5a2c GetKerningPairsA
0x9b5a30 NamedEscape
0x9b5a34 DeleteDC
0x9b5a38 GetDeviceCaps
0x9b5a3c ScaleWindowExtEx
0x9b5a40 DeleteObject
0x9b5a44 SetWindowExtEx
0x9b5a48 ScaleViewportExtEx
0x9b5a4c SetViewportExtEx
0x9b5a50 OffsetViewportOrgEx
0x9b5a54 SetViewportOrgEx
0x9b5a58 SelectObject
0x9b5a5c Escape
0x9b5a60 TextOutW
0x9b5a64 RectVisible
0x9b5a68 PtVisible
0x9b5a6c CreateBitmap
0x9b5a70 SetMapMode
0x9b5a74 RestoreDC
0x9b5a78 SaveDC
0x9b5a7c SetBkColor
0x9b5a80 SetTextColor
0x9b5a84 GetClipBox
0x9b5a88 ExtTextOutW
0x9b5a8c GetObjectW
Library ADVAPI32.dll:
0x9b5a94 RegOpenKeyA
0x9b5a98 RegQueryValueExA
0x9b5a9c GetUserNameA
0x9b5aa0 RegCloseKey
0x9b5aa4 RegEnumKeyExW
0x9b5aa8 RegOpenKeyExW
0x9b5aac RegDeleteValueW
0x9b5ab0 RegDeleteKeyW
0x9b5ab4 RegQueryInfoKeyW
0x9b5ab8 RegCreateKeyExW
0x9b5abc RegSetValueExW
Library SHELL32.dll:
0x9b5ac4 ExtractIconA
0x9b5acc SHEmptyRecycleBinW
0x9b5ad0 FindExecutableW
0x9b5ad4 DragQueryFileAorW
0x9b5ad8 FindExecutableA
0x9b5adc DoEnvironmentSubstW
0x9b5ae0 SHLoadInProc
0x9b5ae4 SHGetFileInfo
0x9b5ae8 ShellAboutW
0x9b5af0 SHFreeNameMappings
0x9b5b00 DragAcceptFiles
0x9b5b04 ShellExecuteA
0x9b5b0c Shell_NotifyIconW
Library ole32.dll:
0x9b5b14 CoRevokeClassObject
0x9b5b1c CoTaskMemFree
0x9b5b20 CoInitialize
0x9b5b24 StringFromGUID2
0x9b5b28 CoTaskMemRealloc
0x9b5b2c CoUninitialize
0x9b5b30 CoCreateInstance
0x9b5b34 CoTaskMemAlloc
Library SHLWAPI.dll:
0x9b5b3c StrCmpNIW
0x9b5b40 StrStrW
0x9b5b44 StrRChrW
0x9b5b48 StrStrIW
0x9b5b4c StrChrA
0x9b5b50 StrCmpNIA
Library COMCTL32.dll:

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702
192.168.56.101 50005 239.255.255.250 3702
192.168.56.101 58368 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.