SmartHawk

6.2

高危

57 个模型检测该样本为恶意！

重新分析

下载样本

805cf02471c7aea7d48d3c83b160fae475066c7d9e520494391ef5646bdcf79f

e95129668014f694a46b1fb3259069e2.exe

分析耗时

95s

最近分析

文件大小

136.1KB

静态报毒动态报毒 100% AGEN AI SCORE=80 ATTRIBUTE BANKERX CLASSIC CONFIDENCE DOWNLOADER34 ELDORADO EMOTET EPAZ GENCIRC GENERICKDZ GENETIC GENKRYPTIK HFIP HIGH CONFIDENCE HIGHCONFIDENCE HPHUZO IY1@ASV8EDPK KCLOUD KRYPTIK MALWARE@#D8LRBN62C9PE R + TROJ R346379 SCORE SGENERIC THHOEBO UNSAFE WQ986+9YMS0 ZEXTET 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRH!E95129668014	20201211	6.0.6.653
Baidu		20190318	1.0.0.2
Avast	Win32:BankerX-gen [Trj]	20201210	21.1.5827.0
Alibaba	Trojan:Win32/Emotet.00097325	20190527	0.3.0.5
Tencent	Malware.Win32.Gencirc.10cde566	20201211	1.0.0.1
Kingsoft	Win32.Troj.Banker.(kcloud)	20201211	2017.9.26.565
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619972234.37625 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619972219.07925 CryptGenKey	crypto_handle: 0x00546c38 algorithm_identifier: 0x0000660e () provider_handle: 0x00546128 flags: 1 key: fõä{F)7Acc¸Jp(	success	1
1619972234.48625 CryptExportKey	crypto_handle: 0x00546c38 crypto_export_handle: 0x005461f0 buffer: f¤ðÜYo3f×µÄ/ !²ÿLnãjÌ¨ïÇá#`%T$e»¯±ÑÝû·p,ô,×ÕÔwÊ &²®ôQ¬»6{ûÏ3YfÐí.¼*s¶P¥Ä¶ blob_type: 1 flags: 64	success	1
1619972264.50125 CryptExportKey	crypto_handle: 0x00546c38 crypto_export_handle: 0x005461f0 buffer: f¤<¹>ËSÌPõáUbFtäT!1Æk_û²{<ox!0ÅQâ÷¥Ä9u¦ðùg,Å¶²'iðJL¯éaòvµO#}ª×eÙ(²9$¹÷t'FãÀt blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619972218.47025 NtAllocateVirtualMemory	process_identifier: 420 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00680000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619972238.42325 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

e95129668014f694a46b1fb3259069e2.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619972236.51725 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (5 个事件)

host	172.217.24.14
host	177.37.81.212
host	74.207.230.187
host	203.208.40.98
host	203.208.41.65

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619972241.00125 RegSetValueExA	key_handle: 0x000003a8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619972241.00125 RegSetValueExA	key_handle: 0x000003a8 value: eÜìA?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619972241.00125 RegSetValueExA	key_handle: 0x000003a8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619972241.00125 RegSetValueExW	key_handle: 0x000003a8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619972241.00125 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619972241.01725 RegSetValueExA	key_handle: 0x000003c0 value: eÜìA?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619972241.01725 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619972241.01725 RegSetValueExW	key_handle: 0x000003a4 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 个事件)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69121
FireEye	Trojan.GenericKDZ.69121
McAfee	Emotet-FRH!E95129668014
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056fe271 )
BitDefender	Trojan.GenericKDZ.69121
K7GW	Trojan ( 0056fe271 )
BitDefenderTheta	Gen:NN.Zextet.34670.iy1@aSV8Edpk
Cyren	W32/Emotet.AOC.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HFIP
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
ClamAV	Win.Packed.Emotet-9528733-0
Kaspersky	HEUR:Trojan-Banker.Win32.Emotet.pef
Alibaba	Trojan:Win32/Emotet.00097325
NANO-Antivirus	Trojan.Win32.Emotet.hphuzo
AegisLab	Trojan.Win32.Emotet.L!c
Tencent	Malware.Win32.Gencirc.10cde566
Ad-Aware	Trojan.GenericKDZ.69121
Sophos	Mal/Generic-R + Troj/Emotet-CKK
Comodo	Malware@#d8lrbn62c9pe
F-Secure	Heuristic.HEUR/AGEN.1136732
DrWeb	Trojan.DownLoader34.10042
Zillya	Backdoor.Emotet.Win32.647
TrendMicro	TrojanSpy.Win32.EMOTET.THHOEBO
McAfee-GW-Edition	BehavesLike.Win32.Emotet.cm
Emsisoft	Trojan.Emotet (A)
Ikarus	Trojan-Banker.Emotet
Jiangmin	Backdoor.Emotet.ow
Avira	HEUR/AGEN.1136732
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Win32.SGeneric
Kingsoft	Win32.Troj.Banker.(kcloud)
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
Gridinsoft	Trojan.Win32.Emotet.oa
Arcabit	Trojan.Generic.D10E01
AhnLab-V3	Trojan/Win32.Emotet.R346379
ZoneAlarm	HEUR:Trojan-Banker.Win32.Emotet.pef
GData	Trojan.GenericKDZ.69121
Cynet	Malicious (score: 100)
VBA32	Trojan.Downloader
ALYac	Trojan.GenericKDZ.69121
TACHYON	Backdoor/W32.Emotet.139377
Malwarebytes	Trojan.MalPack.TRE
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.THHOEBO

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	74.207.230.187:8080
dead_host	177.37.81.212:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-29 19:48:16

Imports

Library SHLWAPI.dll:

• 0x412a60 StrRetToStrA

Library MFC42.DLL:

• 0x41263c

• 0x412640

• 0x412644

• 0x412648

• 0x41264c

• 0x412650

• 0x412654

• 0x412658

• 0x41265c

• 0x412660

• 0x412664

• 0x412668

• 0x41266c

• 0x412670

• 0x412674

• 0x412678

• 0x41267c

• 0x412680

• 0x412684

• 0x412688

• 0x41268c

• 0x412690

• 0x412694

• 0x412698

• 0x41269c

• 0x4126a0

• 0x4126a4

• 0x4126a8

• 0x4126ac

• 0x4126b0

• 0x4126b4

• 0x4126b8

• 0x4126bc

• 0x4126c0

• 0x4126c4

• 0x4126c8

• 0x4126cc

• 0x4126d0

• 0x4126d4

• 0x4126d8

• 0x4126dc

• 0x4126e0

• 0x4126e4

• 0x4126e8

• 0x4126ec

• 0x4126f0

• 0x4126f4

• 0x4126f8

• 0x4126fc

• 0x412700

• 0x412704

• 0x412708

• 0x41270c

• 0x412710

• 0x412714

• 0x412718

• 0x41271c

• 0x412720

• 0x412724

• 0x412728

• 0x41272c

• 0x412730

• 0x412734

• 0x412738

• 0x41273c

• 0x412740

• 0x412744

• 0x412748

• 0x41274c

• 0x412750

• 0x412754

• 0x412758

• 0x41275c

• 0x412760

• 0x412764

• 0x412768

• 0x41276c

• 0x412770

• 0x412774

• 0x412778

• 0x41277c

• 0x412780

• 0x412784

• 0x412788

• 0x41278c

• 0x412790

• 0x412794

• 0x412798

• 0x41279c

• 0x4127a0

• 0x4127a4

• 0x4127a8

• 0x4127ac

• 0x4127b0

• 0x4127b4

• 0x4127b8

• 0x4127bc

• 0x4127c0

• 0x4127c4

• 0x4127c8

• 0x4127cc

• 0x4127d0

• 0x4127d4

• 0x4127d8

• 0x4127dc

• 0x4127e0

• 0x4127e4

• 0x4127e8

• 0x4127ec

• 0x4127f0

• 0x4127f4

• 0x4127f8

• 0x4127fc

• 0x412800

• 0x412804

• 0x412808

• 0x41280c

• 0x412810

• 0x412814

• 0x412818

• 0x41281c

• 0x412820

• 0x412824

• 0x412828

• 0x41282c

• 0x412830

• 0x412834

• 0x412838

• 0x41283c

• 0x412840

• 0x412844

• 0x412848

• 0x41284c

• 0x412850

• 0x412854

• 0x412858

• 0x41285c

• 0x412860

• 0x412864

• 0x412868

• 0x41286c

• 0x412870

• 0x412874

• 0x412878

• 0x41287c

Library MSVCRT.dll:

• 0x41298c ?terminate@@YAXXZ

• 0x412990 _except_handler3

• 0x412994 wcslen

• 0x412998 atoi

• 0x41299c __dllonexit

• 0x4129a0 _mbsicoll

• 0x4129a4 _mbscmp

• 0x4129a8 __CxxFrameHandler

• 0x4129ac _onexit

• 0x4129b0 _setmbcp

• 0x4129b4 _controlfp

• 0x4129b8 __set_app_type

• 0x4129bc __p__fmode

• 0x4129c0 __p__commode

• 0x4129c4 _adjust_fdiv

• 0x4129c8 __setusermatherr

• 0x4129cc _initterm

• 0x4129d0 __getmainargs

• 0x4129d4 _acmdln

• 0x4129d8 exit

• 0x4129dc _XcptFilter

• 0x4129e0 _exit

• 0x4129e4 qsort

Library KERNEL32.dll:

• 0x4125e8 GetTickCount

• 0x4125ec GetCurrentProcess

• 0x4125f0 SizeofResource

• 0x4125f4 GetProcAddress

• 0x4125f8 LoadLibraryExA

• 0x4125fc LoadLibraryExW

• 0x412600 GetModuleHandleA

• 0x412604 GetStartupInfoA

• 0x412608 GetFileAttributesA

Library USER32.dll:

• 0x412a90 DrawIcon

• 0x412a94 SendMessageA

• 0x412a98 IsIconic

• 0x412a9c GetSystemMetrics

• 0x412aa0 GetClientRect

• 0x412aa4 AppendMenuA

• 0x412aa8 GetSystemMenu

• 0x412aac LoadIconA

• 0x412ab0 EnableWindow

• 0x412ab4 GetParent

Library SHELL32.dll:

• 0x412a24 SHGetFileInfoA

• 0x412a28 SHGetMalloc

• 0x412a2c SHGetSpecialFolderLocation

• 0x412a30 SHGetDesktopFolder

Library ole32.dll:

• 0x412aec CoTaskMemFree

Library MSVCP60.dll:

• 0x412920 ??1_Winit@std@@QAE@XZ

• 0x412924 ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

• 0x412928 ??0Init@ios_base@std@@QAE@XZ

• 0x41292c ??1Init@ios_base@std@@QAE@XZ

• 0x412930 ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

• 0x412934 ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB

• 0x412938 ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z

• 0x41293c ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z

• 0x412940 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z

• 0x412944 ??0_Winit@std@@QAE@XZ

• 0x412948 ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z

• 0x41294c ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z

• 0x412950 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

• 0x412954 ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.