1.9
低危
DACN
0.14
FACILE
1.00
IMCLNet
0.60
MFGraph
0.00
反病毒引擎
未检测
暂无反病毒引擎检测结果
静态指标
动态指标
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hummy.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hummy.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\hummy.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(3 个事件)
| dead_host | 198.251.88.188:443 |
| dead_host | 173.209.36.35:443 |
| dead_host | 192.168.56.101:49181 |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-30 18:58:20
PE Imphash
e836076a09dba03e4d6faa46dda0fefc
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x000003d8 | 0x00001000 | 2.018853001442933 |
| .rdata | 0x00002000 | 0x00000474 | 0x00001000 | 1.7348019257994853 |
| .data | 0x00003000 | 0x00000014 | 0x00001000 | 0.036262711990452945 |
| .rsrc | 0x00004000 | 0x000001c0 | 0x00001000 | 1.0593330749615644 |
| .reloc | 0x00005000 | 0x000000b2 | 0x00001000 | 0.28352924868764734 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_MANIFEST | 0x00004058 | 0x00000165 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library WININET.dll:
• 0x402050 HttpSendRequestW
• 0x402054 InternetSetOptionW
• 0x402058 InternetQueryOptionW
• 0x40205c HttpOpenRequestW
• 0x402060 HttpQueryInfoW
• 0x402064 InternetReadFile
• 0x402068 InternetConnectW
• 0x40206c InternetOpenW
Library KERNEL32.dll:
• 0x402000 GetTempPathW
• 0x402004 GetFileSize
• 0x402008 GetCurrentDirectoryW
• 0x40200c DeleteFileW
• 0x402010 CloseHandle
• 0x402014 WriteFile
• 0x402018 lstrcmpW
• 0x40201c ReadFile
• 0x402020 GetModuleHandleW
• 0x402024 ExitProcess
• 0x402028 HeapCreate
• 0x40202c HeapAlloc
• 0x402030 GetModuleFileNameW
• 0x402034 CreateFileW
• 0x402038 lstrlenW
Library USER32.dll:
• 0x402048 wsprintfW
Library SHELL32.dll:
• 0x402040 ShellExecuteW
L!This program cannot be run in DOS mode.
898k8k8Rich8
`.rdata
@.data
@.reloc
_3^@[VP
CVMQuPu
VSVuhL!@
tVVVVhX!@
0EPEVV4
_EPEPj S}
WEPj S
3VVVVS
u3VEPEPh
u+};}t
wgwwM7wO!w>w-w&<wVww
"qAw!q~!qBJ"qu\"q
!q,I"q"q
InternetOpenW
InternetConnectW
HttpOpenRequestW
InternetQueryOptionW
InternetSetOptionW
HttpSendRequestW
HttpQueryInfoW
InternetReadFile
WININET.dll
GetModuleHandleW
ExitProcess
HeapCreate
HeapAlloc
GetModuleFileNameW
GetTempPathW
CreateFileW
GetFileSize
lstrlenW
ReadFile
lstrcmpW
WriteFile
CloseHandle
DeleteFileW
GetCurrentDirectoryW
KERNEL32.dll
wsprintfW
USER32.dll
ShellExecuteW
SHELL32.dll
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>PADPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
10>0L0Y0g0s000000000
1E1m1v11111111
282A2h2p22222
3F3z3333333
L!This program cannot be run in DOS mode.
i2h:2h:2h:2i:gh::1h::3h:)%:"h:)%:Ph:)%:
h::3h::*h::3h::3h:Rich2h:
`.data
@.reloc
otools\inc\nlg\private\inc\msfsa\faarray_cont_t.h
otools\inc\nlg\private\inc\msfsa\falextools_t.h
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
bad exception
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
Unknown exception
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
nlg\lib\msfsa\faallocator.cpp
nlg\lib\msfsa\farsdfa_pack_triv.cpp
otools\inc\nlg\private\inc\msfsa\faarray_cont_2xresize_t.h
nlg\lib\msfsa\famultimap_pack.cpp
Internal error.
Object cannot be initialized.
Limit size has been exceeded.
Out of memory.
Object is not ready.
]ut5p?
W3+t#Hu7Vu
^3[UQE
V3WM0u
UVW39~
<|uCt7
t79V$t2h
M 3UE9J
MA3;~\U
E;}q}M
PE @PE
MPE+@PE
G;}|}]}$
F;}^U9]
z;~\;}T;]
Yt]U]U]
EVW3EP
/ c o m m e r c i a l / m r x 3 0 d . e x e
/ i d e v a f f i l i a t e / d o c s / x 3 0 d o t . e x e
g r o u p e s o r e p c o . c o m
b u l k b a c k l i n k s . c o m
h u m m y . e x e
U p d a t e s d o w n l o a d e r
t e x t / *
a p p l i c a t i o n / *
w i n y g . e x e
C : \ 3 H D t m R v 0 . e x e
C : \ c h e x 5 y r I . e x e
C : \ 6 7 8 c 9 1 c c 2 6 f 7 1 6 4 2 7 6 b 6 9 6 7 4 8 9 7 d 7 5 d a c 0 2 c 3 7 5 6 8 7 a 6 6 b 6 b c 6 9 8 b f 7 e a 4 7 f f f 6 0
C : \ K p 0 k X 8 7 L . e x e
C : \ D e M T 3 8 U N . e x e
C : \ v 7 A T k i _ j . e x e
C : \ Y F B d 6 8 H X . e x e
C : \ 6 4 o H 3 O x c . e x e
C : \ t F I a c E P c . e x e
C : \ w W A m X c g 5 . e x e
C : \ k Y e X v r x i . e x e
C : \ s r D V y 8 A p . e x e
C : \ u g _ H d 3 I 5 . e x e
C : \ 3 E 6 W G 0 O 5 . e x e
C : \ b I n 9 m w C Q . e x e
C : \ r i r D 5 b K T . e x e
C : \ O I l 2 _ N D m . e x e
C : \ 9 h 2 j G C K K . e x e
C : \ a a 9 b 2 2 a a e d 4 8 9 6 5 a 7 c 4 8 e b 9 c 9 b 1 a 9 c e b 0 f 9 6 7 8 f e 9 d 4 4 c 7 b c d 1 b c 6 5 e 7 c f 2 5 1 8 a a
C : \ b e 9 1 0 e a 4 d 8 e 0 5 3 8 c 7 7 0 2 a 9 b 5 4 1 f 9 d b d 9 1 f 5 e f 6 9 6 b 2 1 a c 9 2 7 f 0 3 5 9 d c f 3 1 d 6 d d 4 d
C : \ 9 P f J z c N Z . e x e
C : \ 5 x d B H a V w . e x e
C : \ D o I S L 6 5 s . e x e
C : \ n F 7 D e 2 1 B . e x e
C : \ U V a 9 K K x p . e x e
C : \ a g r p s p K Y . e x e
C : \ g W B k T 8 E w . e x e
C : \ o s M B a 7 a 1 . e x e
C : \ i 7 o g U o a c . e x e
C : \ T s K 8 6 L d z . e x e
C : \ T o C 5 k F 3 p . e x e
C : \ 2 p G O S V 4 A . e x e
C : \ A l Q 5 B L c T . e x e
C : \ S S C l M A 4 h . e x e
C : \ z S _ 3 S S x 6 . e x e
C : \ k F f C Z S t 8 . e x e
C : \ c B j h 7 P 4 4 . e x e
C : \ z 5 q M h S l t . e x e
C : \ w e v y B h W v . e x e
C : \ s Z c u I C E d . e x e
C : \ o 0 8 c d G w V . e x e
C : \ f c f 5 b 2 1 6 c 6 d e 0 b e f 5 b 8 9 6 7 2 b 4 f a 8 f 6 a 0 5 9 f a 4 b 9 2 e 2 9 a f 2 b d f 7 c 9 d e 9 6 9 2 6 8 0 0 d 1
C : \ 4 5 c 6 b f b 4 0 6 f d 2 e 9 6 0 7 b 5 b a d d 8 f 1 7 b c b 0 9 a a 1 9 8 9 4 a 6 5 2 a c 4 d 0 a 0 c 7 9 f 0 b 3 6 f 4 8 5 c
C : \ 3 c 8 6 e d d e 2 d 5 a f 4 0 1 5 e c d 2 d 4 b 1 b e b 4 4 f e f 4 b d a d e 0 5 e f d d 6 c 6 d d 2 6 c 6 1 0 6 3 f a 3 b 9 4
C : \ 1 9 1 4 d 3 b b 6 9 c 2 6 0 5 5 8 2 4 9 8 0 6 1 1 a 9 5 5 2 3 a 3 9 3 d 9 9 c d a 4 6 1 e 1 9 3 e 0 b f e 7 f 7 9 4 3 0 8 d 3 d
C : \ R _ f Q N k w 9 . e x e
C : \ S _ T B d 4 b T . e x e
C : \ N L K i w B 3 y . e x e
C : \ W m v t C f f 3 . e x e
C : \ y C f i Q x B E . e x e
C : \ p k m 5 o e 1 N . e x e
C : \ u N 9 j 7 h C C . e x e
C : \ b C r Y Y e s M . e x e
C : \ 9 Y 0 Y h O E S . e x e
C : \ 9 7 J e z c w c . e x e
C : \ v N k W M s E d . e x e
C : \ V K E A U g 4 C . e x e
C : \ _ B b z b X n C . e x e
C : \ p Q 6 2 w l p H . e x e
C : \ E P H 1 s n V r . e x e
C : \ D b y g 8 q o e . e x e
C : \ 8 7 0 e b 1 f c c b 8 3 8 8 2 a 9 7 f e 9 a 1 d 3 1 3 8 3 8 5 a 9 2 4 7 2 2 1 b 5 6 d 5 9 f e 1 0 7 b 8 1 6 a 0 3 d a 6 c d 3 4
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ Q j g Y 0 u W q . e x e
C : \ z S 2 M W h C u . e x e
C : \ o t _ j s c l 8 . e x e
C : \ P 1 d w y 9 x M . e x e
C : \ 7 7 9 2 p b j 1 . e x e
C : \ G 0 G I v B q x . e x e
C : \ j 5 d c m u A Z . e x e
C : \ T s b c 0 5 c Q . e x e
C : \ M z l V A 5 q s . e x e
C : \ y 8 Y H q h Y w . e x e
C : \ p t O P Z u 0 _ . e x e
C : \ 4 5 d E D P Y v . e x e
C : \ 0 N X F t L Y 5 . e x e
C : \ m H 4 H w Y w Q . e x e
C : \ 8 v i N p G w y . e x e
C : \ 5 1 T N K Y e E . e x e
C : \ F G C n p M Y W . e x e
C : \ b 8 z Z F y y P . e x e
C : \ a p X q o X E w . e x e
C : \ i 1 Q 3 F W o l . e x e
C : \ I R r 7 l i v X . e x e
C : \ V A N 8 R 2 J 0 . e x e
C : \ U V u P G E 7 m . e x e
C : \ w R V 4 K b Z W . e x e
C : \ 1 h J 0 q 7 W q . e x e
C : \ L P n k H f L V . e x e
C : \ P v 5 V C L 8 W . e x e
C : \ j k s s _ z k G . e x e
C : \ Q O C a b g R Y . e x e
C : \ W G K j M E 2 f . e x e
C : \ L 5 3 7 x B y z . e x e
C : \ t b m T l b K s . e x e
C : \ T R 6 d Z 6 S R . e x e
C : \ S s _ o Q v z z . e x e
C : \ Z v 5 D l _ K g . e x e
C : \ w r Z i p G a 8 . e x e
C : \ i N u D 1 i m _ . e x e
C : \ y R N 3 S i f z . e x e
C : \ j 3 Y Z 2 S 8 V . e x e
C : \ 4 s c Z d 4 E D . e x e
C : \ G f L q J 2 0 Z . e x e
C : \ A 2 R E b V N x . e x e
C : \ e L b O J 9 f Y . e x e
C : \ I 0 A J 7 g g K . e x e
C : \ Y P u d M M a a . e x e
C : \ e i M M A a e 1 . e x e
C : \ D j p 7 M c 4 D . e x e
C : \ H K u t e R B Z . e x e
C : \ S 5 A y J T p L . e x e
C : \ K R z f i F L T . e x e
C : \ p V J m s P c 4 . e x e
C : \ S h h 5 p K Q O . e x e
C : \ F 9 4 z j S 8 F . e x e
C : \ i Y M q 2 F V 3 . e x e
C : \ c S 3 W E P c e . e x e
C : \ 1 T k V H V Q H . e x e
C : \ f g R _ 3 N i Q . e x e
C : \ 5 h N S h S R V . e x e
C : \ X s c s t 5 t c . e x e
C : \ u X H 9 L t O S . e x e
C : \ U a V y _ 3 3 A . e x e
C : \ i O o G t M a Q . e x e
C : \ x m s R Y P N 8 . e x e
C : \ t B K D L 1 t E . e x e
C : \ p y r N O C Y v . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ o S j s T 0 R Z . e x e
C : \ _ A 6 6 P v z v . e x e
C : \ k R a x R 1 V Z . e x e
C : \ 8 Z n w W P Q e . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ O V M O K t Z c . e x e
C : \ K L B R d 8 3 L . e x e
C : \ g I t _ W 0 g k . e x e
C : \ M O 4 n 4 G q z . e x e
C : \ m m v 0 S F C D . e x e
C : \ T h f 8 x 6 a q . e x e
C : \ u v O 6 q z c o . e x e
C : \ 1 1 d 9 d a 8 6 c d e d f 6 a a c 6 b f 9 d 2 6 2 3 a 3 2 e 6 d f 5 f 5 0 a 1 c 9 8 1 0 a b 6 b b 8 3 d 4 f 1 e 8 4 8 8 9 1 9 d
C : \ x h V L a f t F . e x e
C : \ l 0 b v o f 6 o . e x e
C : \ K P j e s 7 c A . e x e
C : \ X c 8 J 3 7 v 8 . e x e
C : \ h P s 1 I L U P . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 8 e Y U S i s 2 . e x e
C : \ a d W U 8 b D Y . e x e
C : \ K s V U P F 5 4 . e x e
C : \ m o H O x M D f . e x e
C : \ 2 O T 9 W V 5 a . e x e
C : \ R u l A P G 1 O . e x e
C : \ 9 v y S h 5 d A . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ d d i M q k I c . e x e
C : \ 3 U S i c y 4 H . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ S j w n I P s a . e x e
C : \ b 6 c o l L 6 7 . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ d x O x L o e v . e x e
C : \ V Q K 9 E E L V . e x e
C : \ l b D F p m n C . e x e
C : \ B B 3 2 H 4 e U . e x e
C : \ X R d N o 8 C l . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ I o y j b E H z . e x e
C : \ i G K H v y r j . e x e
C : \ y U o A c P t 6 . e x e
C : \ U s e r s \ l u s e r \ D e s k t o p \ F Z 6 7 O p 7 0 . e x e
C : \ L a t P 3 Z I 8 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ E J C P 5 b 9 q . e x e
C : \ j S J N I t j Q . e x e
C : \ u A 6 8 K r R u . e x e
C : \ W k c 5 t t v P . e x e
C : \ o i B 6 s 3 R k . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ t C e p 1 l 0 O . e x e
C : \ 5 6 1 1 2 9 b 6 7 d 1 7 5 c 5 8 4 1 d 7 f 3 b a 0 e 4 e 0 b a f 2 3 a 5 8 0 9 9 b d 1 d 6 a 3 5 a a c 0 6 9 8 9 5 c 9 8 f 6 6 3
C : \ V R k d B f n z . e x e
C : \ t M F z r V p I . e x e
C : \ r u o W c L b U . e x e
C : \ k I G w f p A O . e x e
C : \ 3 3 3 s M P l O . e x e
C : \ 2 u 9 Z J 7 A X . e x e
C : \ U s e r s \ J o h n n y C a g e \ D e s k t o p \ u J d z g t G g j 2 . e x e
C : \ t 0 F I T N E _ . e x e
C : \ D 4 v C s A t H . e x e
C : \ b 1 x V j t 1 I . e x e
C : \ J c 1 T j d Y r . e x e
C : \ e y 5 H c N z m . e x e
C : \ 7 _ 9 t W C t d . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ L g a Y N o a G . e x e
C : \ m y a 9 E D p N . e x e
C : \ Y s H y B 4 n W . e x e
C : \ U j S A C i r h . e x e
C : \ H P w D I u t 9 . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ T E r 4 S v r h . e x e
C : \ s _ n l P I D J . e x e
C : \ b h G 4 l o 1 b . e x e
C : \ U 9 9 i 0 B O 3 . e x e
C : \ V i 8 O 2 F q 0 . e x e
C : \ R 9 s V S w U W . e x e
C : \ H u R X l h a n . e x e
R E S O U R C E _ F A T O K E N I Z E R
K E R N E L 3 2 . D L L
s m s c o r e e . d l l
n r u n t i m e e r r o r
T L O S S e r r o r
S I N G e r r o r
D O M A I N e r r o r
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- C R T n o t i n i t i a l i z e d
- u n a b l e t o i n i t i a l i z e h e a p
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- u n a b l e t o o p e n c o n s o l e d e v i c e
- u n e x p e c t e d h e a p e r r o r
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
< p r o g r a m n a m e u n k n o w n >
R u n t i m e E r r o r !
P r o g r a m :
H H : m m : s s
d d d d , M M M M d d , y y y y
M M / d d / y y
D e c e m b e r
N o v e m b e r
O c t o b e r
S e p t e m b e r
A u g u s t
F e b r u a r y
J a n u a r y
S a t u r d a y
F r i d a y
T h u r s d a y
W e d n e s d a y
T u e s d a y
M o n d a y
S u n d a y
W U S E R 3 2 . D L L
( ( ( ( ( H
C O N O U T $
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 3 b b 7 8 3 2 d f 0 8 6 3 a 0 7 8 d 1 1 7 a 9 d b 3 f 5 f 4 c b f 3 f 5 c b 7 5 3 0 a 3 0 5 2 0 8 3 6 b d 8 5 3 8 5 2 3 b 6 a . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ A H x r n I d f . e x e
C : \ 2 2 6 d 7 b 4 5 c b 1 6 4 7 1 3 5 4 8 b 5 1 e f 2 4 5 8 5 b 6 7 8 9 0 6 d 7 1 3 d f c 7 d 1 5 8 3 c b 1 2 8 e 6 e 6 0 2 4 d 1 e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ N 5 J t X B I 0 . e x e
C : \ d a f 3 1 1 9 1 a e c 8 6 d 1 d 1 1 6 4 4 8 c 2 8 d 3 4 e a 2 7 9 7 b 6 1 a b c 7 b 3 e 8 c d 0 3 a 3 f b 7 8 f f 0 5 2 e 7 5 b
C : \ 7 2 1 3 d 1 1 a 0 7 6 e 2 4 f 7 b 1 f 9 1 4 0 3 0 1 4 7 a 0 6 d d 0 0 b 1 4 1 4 f 6 c 3 3 c c 6 8 3 f 3 2 e 9 f c 6 c f c 4 2 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d a a a 3 6 3 2 0 9 6 5 f 5 b 0 _ h u m m y . e x e
C : \ f 2 0 3 7 c 5 a 8 a 6 c 8 0 2 5 4 b d 2 b 2 7 3 b b 0 4 d c 0 b e 1 5 0 4 1 a 2 9 1 4 c e 0 8 5 f 4 a 0 6 3 e a c 2 0 1 8 8 0 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ b 1 a c 5 7 e 8 1 6 0 a e 8 7 0 e 9 2 4 7 d 2 0 3 a 7 b 0 6 c 7 e 2 1 b d c 1 2 3 3 7 1 0 d d 4 3 9 7 5 a 6 0 d 7 0 d e b 8 1 5
C : \ a 7 1 7 3 9 1 e 3 4 a 4 a 0 c 9 c e 6 4 4 7 4 f 8 7 6 d c 8 d c 8 3 2 3 d 5 7 a 8 f 3 9 3 7 8 e 8 e a 0 e 8 c 3 b b 2 f 0 9 f 0
C : \ a 1 3 6 b 8 3 6 7 4 e 6 c f 3 2 5 f 8 6 6 8 2 8 f 6 f 9 3 f b 1 2 c 8 0 0 6 b 9 0 4 0 c 7 e 0 c d d 3 9 c c 2 7 3 3 3 8 5 8 f f
C : \ a 5 2 2 1 1 8 d 3 d 8 0 8 0 4 5 b 2 7 3 8 9 0 6 4 5 5 7 d f 1 e 4 3 7 f 8 a 7 2 7 2 e 4 3 4 7 d d d 0 6 d d d 8 2 9 4 3 3 f 6 9
C : \ 1 c 3 3 0 a a 9 4 0 7 4 2 d 9 0 3 b f a 9 4 3 d d 3 7 f 5 a 0 3 b 0 c e 1 9 7 4 7 a 6 8 5 d f 2 a 6 a b 4 1 d 0 a 3 a 3 7 c 7 7
C : \ f 6 c f 7 a 4 b 1 5 9 9 e 3 7 4 5 3 1 f b 1 8 3 a 0 8 9 3 d f b c 4 6 2 d e c 7 0 5 5 7 6 0 4 5 6 8 2 b a 3 9 a a b 4 8 9 d 2 b
C : \ c a 6 3 8 b 2 b e 5 6 9 2 1 5 7 f d f 3 4 e 5 f 8 f 2 a f 2 f 1 5 3 9 5 6 3 5 0 c 5 9 c f 5 b 4 7 f 8 0 5 9 1 3 4 c d c 7 3 6 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 3 2 c 5 b 7 3 f 7 7 f 4 2 6 c e f b c 4 a 7 a a c e 3 7 9 0 e 6 5 b d 4 b 6 d 4 e c 9 f 6 7 4 6 b d d b 4 5 9 4 2 5 7 8 f 8 4 d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ e 5 U 9 V g D L . e x e
C : \ 9 c 2 5 5 b 2 3 a 7 2 6 7 b 8 9 f 0 a c 9 a d 1 9 7 8 8 2 e 2 f 6 9 8 1 b 0 d 1 e b 2 9 6 3 a 3 b e 3 f 0 5 8 4 e d 4 0 e 0 8 7
C : \ 8 e b f d a 1 5 e 8 8 6 b 6 a a b 6 b 5 1 7 7 6 1 6 3 9 b e 2 3 9 2 6 d c a 6 e c 2 b 3 9 5 b c 3 c 6 9 a 7 9 0 f 9 2 8 8 9 e a
C : \ 8 f 2 6 f b 4 1 4 0 7 2 e d 0 d a 6 9 1 0 7 b e 4 f f f 5 7 0 4 f 0 4 8 9 7 b 8 3 3 a e 6 2 c 1 f b 5 4 e 3 b 4 f f b 9 5 c f d
C : \ 7 1 c 2 9 4 9 8 1 c 9 1 c b b d 6 7 e d d 3 1 e a 7 9 7 3 6 b c d e 4 c 1 6 1 6 a 0 c f 7 7 8 8 9 f 3 4 4 7 f 1 0 7 3 d e a b b
C : \ 9 d e 0 2 b 5 d 2 4 b 9 d 6 8 f 9 e 1 e 9 b 1 5 6 d 3 d d f 2 1 c 3 1 9 1 5 9 7 d 7 4 5 6 8 2 2 5 5 9 7 d 0 3 c 9 d a 9 3 1 9 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
c : \ t a s k \ 0 1 D 7 8 2 9 7 1 9 0 8 8 6 7 4 4 8 6 F 0 F C 1 B B 7 3 C F 4 3 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ e 0 4 2 e 1 c 8 f 4 c 6 5 f 8 3 0 d 0 2 a 3 8 5 7 c a a 5 c 1 0 . v i r u s . e x e
C : \ 1 b 5 8 e b d 6 0 b 7 f e 3 0 8 5 7 4 c 6 6 9 2 2 e 9 f 2 2 0 2 2 6 e d 5 2 1 b 0 5 d c e f 1 4 6 1 9 5 1 e 3 f d e 0 f 3 5 e 2
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ r x 1 Q h G U U . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 9 a 7 3 4 4 5 6 6 b 2 7 7 1 6 d d a e 2 f 0 d e 6 e a 7 9 3 b e 6 d a 6 9 e d c b 2 8 1 c 0 7 7 a 4 0 7 6 e 4 1 d d 7 5 1 3 c . e x e
C : \ f 6 c f 2 a 7 4 0 4 5 c b 7 e 2 c 1 e e 5 4 7 7 c 1 8 3 9 6 b 2 2 a f 0 6 6 7 7 5 b 0 2 c c 4 4 5 b 8 b e 9 7 2 a 5 e 4 a 1 8 b
C : \ f f 1 7 1 4 5 6 8 5 b 7 f 9 8 1 1 7 0 0 2 4 0 e 7 a d 7 4 c 4 f 1 a d d d 6 a e 0 6 4 e 4 3 a 6 a 2 c 4 f 7 8 8 3 4 b 0 7 1 f f
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ k M c 9 t L N A . e x e
C : \ 1 b 8 5 7 7 c a 9 f e 4 2 3 d e 3 7 1 b d c 7 4 1 c a 2 0 7 a 7 9 1 4 4 e 4 7 3 a 8 2 5 8 7 2 a e e 9 f 7 6 a 6 9 8 4 c e 6 a 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ 2 V T I q l k 1 . e x e
C : \ 5 d 5 9 f 1 f 4 5 3 4 9 9 f a f 8 d a f d e e 6 7 8 a 3 9 0 3 6 4 f 0 b 5 3 5 2 f c c b 7 1 b 5 6 f d 8 2 d a 1 e 2 0 3 3 3 3 0
C : \ b e a 3 d 2 6 5 0 d e c 2 d 7 b a 4 9 e 0 1 d c 8 3 0 8 5 0 4 b 8 2 f a 8 c 1 9 7 8 5 8 f b 8 d 8 4 6 4 7 f c 8 b 6 5 e c 5 4 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ d d f a e 7 d 2 c c d b a 5 b 4 b 8 a 0 e 1 6 a b 8 d 3 2 4 0 3 8 d 6 6 5 3 3 7 6 5 b c 4 f 8 5 d 7 b 3 e 9 b 2 a d 5 3 e f 4 f
C : \ b e 2 f 4 7 3 d 7 3 7 3 0 a b 7 f 8 b 9 3 c 7 e f c f 8 5 1 4 7 1 4 4 9 3 2 5 2 1 1 4 d e 8 b 3 5 e c 8 1 1 8 7 e b 5 9 d 2 2 e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ f e b 4 5 f 3 7 7 8 1 2 8 f 6 1 0 4 0 d 2 f 1 6 5 c 0 4 f e 2 c 6 7 7 7 3 3 f b 6 8 b 0 4 d a 0 8 1 e 5 e 5 1 8 8 b 3 6 f c 5 a
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f 9 6 c 1 3 5 d 9 a 5 8 9 4 1 3 _ h u m m y . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ b 6 6 b 1 7 5 7 0 1 9 e d f 2 3 c 1 c 1 a f d 0 2 b a 7 d a 3 1 7 d d 4 7 4 7 6 d 1 9 d c 5 3 3 4 7 4 4 3 3 f 0 7 4 7 8 4 7 6 a . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 9 a 9 b 8 3 5 1 d 8 1 f 1 a 6 1 9 8 a 0 7 6 4 0 7 a 8 1 f 5 9 1 9 7 b 4 8 7 3 4 a c 6 d 5 4 5 1 9 1 a 2 d 1 b 6 5 6 c a 9 d f . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ d 9 2 3 4 f e 5 e 2 7 7 a f f f d c 3 e 0 d 3 5 d 9 0 e 9 3 5 9 5 b 5 a 1 1 7 2 f 5 a 9 f a e 1 1 4 6 6 3 e 6 3 f 3 6 d 9 6 7 6 . e x e
C : \ d 7 a 8 2 1 5 4 5 d 4 c 4 1 3 7 b 7 8 a f e 4 b c 6 9 9 9 1 8 a e e 4 b 9 8 a a 9 7 f d 4 7 8 e d 5 9 c 5 3 e 0 b e 8 7 4 4 c b
C : \ 0 e 8 c c 6 1 e 5 8 9 2 1 7 7 7 4 4 6 7 6 7 7 7 6 4 c 1 2 8 7 9 8 9 8 a 4 0 8 2 3 3 d 6 8 7 1 a a f 8 6 9 7 0 7 e b f c a a 0 6
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ f 0 8 3 8 8 4 a 5 d a b b 6 8 a d 7 1 b 2 7 8 e 9 d 4 9 f c 3 b . e x e
C : \ U s e r s \ V i r t u a l \ A p p D a t a \ L o c a l \ T e m p \ b 7 0 8 6 9 5 0 6 3 4 3 e 8 2 9 7 3 d 9 a 8 3 4 e b 7 5 9 f b a 2 d 5 c 4 7 f 6 f 5 7 6 5 d e a 4 a 1 3 7 d 9 e 9 7 6 c 2 7 2 7 . e x e
C : \ 5 e f 3 8 c 5 0 b 9 e d 1 5 7 a c 9 5 9 4 7 5 9 0 d 4 5 a 5 b d c 6 d f 9 d f f 9 f e 4 5 d e c 1 6 3 a 3 8 f 0 0 3 0 8 9 d b c
C : \ 7 7 d 9 3 4 a 9 e 9 9 2 3 e e 1 1 9 4 6 f 3 3 1 9 6 c 7 7 2 e e 9 d 4 b 9 a 7 d 4 c 1 5 0 3 4 c 7 0 9 5 d b c 3 d a a 6 4 d 9 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 8 0 b 3 8 8 c 2 5 4 7 a b f d c 1 2 2 8 9 8 0 b c e e f b 6 a 0 1 9 2 8 a a a 9 0 a 4 7 d 2 0 1 9 d d b 4 7 4 3 5 1 a 5 2 b 9 . e x e
C : \ 3 2 1 e e d 1 c a 5 b f 4 0 0 7 6 e 0 f b 3 4 0 e 5 2 9 1 4 3 7 6 d f e d 0 f c 3 8 8 a 2 5 6 8 7 5 7 b 0 7 a a 9 7 8 6 f d 3 b
C : \ 0 8 b 0 c 3 a 9 6 2 e d 7 f a f 2 6 f e 7 f 9 3 3 9 c 3 c 3 0 7 c 3 b a 8 8 c 3 2 f 7 8 d e a 3 a a 9 9 5 f b 4 d 2 0 9 6 6 f d
C : \ 8 4 f 2 c f e 6 4 0 d 0 1 3 e 7 8 0 4 8 a 5 b 7 4 e 1 8 f a 9 5 1 1 2 1 3 d 3 4 b e 3 8 5 a 7 e 2 a a 2 2 1 e d 2 0 5 e 7 7 c e
C : \ 4 9 8 5 b c 7 6 1 f 5 5 d d 0 e e 2 4 8 9 b b 4 2 9 6 4 7 9 5 2 9 6 c c 9 5 6 e 1 4 6 e 0 0 9 f 9 e 6 7 7 e 2 8 8 1 d 7 2 2 9 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ 1 2 c 5 9 1 e f 7 7 c d 2 3 7 1 b f 9 f d 1 3 c 9 8 3 4 f 1 a 6 8 0 2 8 7 3 4 4 1 f 8 6 b 4 6 f 5 8 e 2 2 d 3 9 2 1 9 5 c 6 3 4
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ h u m m y . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 6 6 9 a f 0 5 c d 0 c a 6 6 6 1 _ h u m m y . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 5 9 c d e 5 a 2 5 0 0 d 0 b b 2 b 0 1 8 f 2 5 c d c b a c a 6 b c 9 b b d 5 1 4 5 4 9 1 9 2 6 8 8 3 4 2 8 5 8 b 1 3 0 a 0 7 8 . e x e
C : \ U s e r s \ R A 4 9 1 ~ 1 . V U L \ A p p D a t a \ L o c a l \ T e m p \ f 0 8 3 8 8 4 a 5 d a b b 6 8 a d 7 1 b 2 7 8 e 9 d 4 9 f c 3 b . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ f u Q g 1 0 x I . e x e
C : \ 7 4 2 8 9 4 0 d 8 e e 4 8 7 a 2 1 1 5 a c b 5 6 d 3 c e 4 5 d 4 a 2 3 d 6 c 5 a e 7 a 5 4 3 b 0 d b d b 2 0 2 9 c 2 d 1 b f b c
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ h u m m y . e x e
C : \ a a 3 4 b a e b 9 d 3 b c 2 9 1 4 0 0 d 2 1 4 9 0 0 d 3 6 d e a 2 5 7 e 1 2 8 8 6 1 0 0 d 0 5 8 5 3 a 9 a e e c 0 4 d 0 7 2 4 c
C : \ 8 9 7 e 2 b d a 7 2 6 6 9 9 b c 9 c 1 c 1 c b 6 4 1 1 d a 0 c 3 0 8 3 a 2 2 3 b f 6 a 3 e 8 b c f 1 c a 5 0 b e f 4 1 4 6 a 9 c
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ x A D 0 O 4 u T . e x e
c : \ t a s k \ A 6 F 8 8 A E 8 6 2 F 4 3 C 9 F A E 1 D 5 2 2 5 1 A D 9 B E 5 4 . e x e
c : \ t a s k \ C 8 A 3 2 5 0 2 1 A 0 6 D 3 5 6 7 3 0 8 0 5 F 0 7 7 4 7 4 9 9 1 . e x e
c : \ t a s k \ 8 1 8 4 2 A E 6 C 8 2 D C 8 C 9 2 F B 9 1 0 F 9 8 B 4 1 8 E 4 7 . e x e
c : \ t a s k \ 3 9 5 E 4 1 B C 7 3 9 1 0 E B 5 0 9 0 C 8 9 D 2 4 F 0 F 9 7 7 1 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ f a a 3 c 1 5 d 6 4 0 2 6 4 d a 1 2 a 6 5 d e 9 d 3 c 4 3 9 b c . v i r u s . e x e
C : \ 9 b 4 9 0 7 9 b 1 f 2 8 6 6 4 8 e 4 3 3 a e 4 6 8 7 1 3 2 b b 0 5 d a 1 c c e 3 2 b 3 c a c 0 f 2 4 d a d 3 f f d 4 4 0 7 5 2 9
C : \ 5 7 a b f d b c 3 2 9 e 9 7 5 9 2 7 2 e e d 7 d c 1 f 5 5 4 4 f 7 5 f b e d f 6 3 0 e a f d 2 3 1 1 e b c b d 8 6 f 6 c d 4 c f
Process Tree
-
0c7c2716cb298c0683c1d1e6337bacad7e62c11ec08f228b2de44c45e3fa0217.exe (1932)
"C:\Users\Administrator\AppData\Local\Temp\0c7c2716cb298c0683c1d1e6337bacad7e62c11ec08f228b2de44c45e3fa0217.exe"
- hummy.exe (2160) "C:\Users\ADMINI~1\AppData\Local\Temp\hummy.exe"
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | 131.107.255.255 | |
| bulkbacklinks.com | A 198.251.88.188 | 198.251.88.188 |
| groupesorepco.com | A 173.209.36.35 | 173.209.36.35 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49165 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49166 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49167 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49169 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49170 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49171 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49173 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49174 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49175 | 173.209.36.35 groupesorepco.com | 443 |
| 192.168.56.101 | 49178 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49179 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49181 | 198.251.88.188 bulkbacklinks.com | 443 |
| 192.168.56.101 | 49183 | 198.251.88.188 bulkbacklinks.com | 443 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 51758 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 7f19ef9ffbb6dc7e_hummy.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\hummy.exe |
| Size | 72.6KB |
| Processes | 1932 (0c7c2716cb298c0683c1d1e6337bacad7e62c11ec08f228b2de44c45e3fa0217.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | c4fe0903c6aaabe92ed3129afc619841 |
| SHA1 | 006e53a579b863365f6ca4c14f5c620bde6fff75 |
| SHA256 | 7f19ef9ffbb6dc7e7e5c9cfe1e625732c3cadf8481b7db6e4db6d841b7a953dc |
| CRC32 | 9EBC7506 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.