SmartHawk

3.2

中危

48 个模型检测该样本为恶意！

重新分析

下载样本

4b4c8b74b632893033dfa8d4099db76155f6941ab5a63ba7c5a680168ad73b1b

ea55176cb12e5d09ad65548a021fd339.exe

分析耗时

139s

最近分析

文件大小

124.0KB

静态报毒动态报毒 AI SCORE=83 AIDETECTVM AKYN ATTRIBUTE BTQYTX CONFIDENCE EMGS FAREIT GENERICKD GULOADER HIGH CONFIDENCE HIGHCONFIDENCE HLICCA HM0@AKZ6ONFB IGENT KDJHY MALWARE1 MALWARE@#2H2C8FZ6ZGZU3 QVM03 R011C0DF520 R339532 SCORE SUSGEN UNSAFE VEBZENPAK ZEVBAF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Fareit-FST!EA55176CB12E	20200726	6.0.6.653
CrowdStrike	win/malicious_confidence_80% (W)	20190702	1.0
Alibaba	Trojan:Win32/Vebzenpak.8a9ce21c	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Kingsoft		20200726	2013.8.14.323
Tencent	Win32.Trojan.Vebzenpak.Akyn	20200726	1.0.0.1

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951397.565017 GetComputerNameA	computer_name: OSKAR-PC	success	1	0
1619951397.565017 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951397.565017 GlobalMemoryStatusEx		success	1	0

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951398.533017 NtAllocateVirtualMemory	process_identifier: 2368 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00530000	success	0	0

Foreign language identified in PE resource (1 个事件)

name

RT_VERSION

language

LANG_CHINESE

offset

0x0001d150

filetype

data

sublanguage

SUBLANG_CHINESE_TRADITIONAL

size

0x000002a4

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619951395.580017 NtProtectVirtualMemory	process_identifier: 2368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffff base_address: 0x003c0000	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.407945481072465

section

{'size_of_data': '0x0001b000', 'virtual_address': '0x00001000', 'entropy': 7.407945481072465, 'name': '.text', 'virtual_size': '0x0001a19c'}

description

A section with a high entropy has been found

entropy

0.9

description

Overall entropy of this PE file is high

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 个事件)

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Trojan.GenericKD.43284836
FireEye	Generic.mg.ea55176cb12e5d09
McAfee	Fareit-FST!EA55176CB12E
Cylance	Unsafe
Zillya	Trojan.Injector.Win32.741448
Sangfor	Malware
CrowdStrike	win/malicious_confidence_80% (W)
Alibaba	Trojan:Win32/Vebzenpak.8a9ce21c
K7GW	Trojan ( 005681011 )
K7AntiVirus	Trojan ( 005681011 )
Arcabit	Trojan.Generic.D2947964
TrendMicro	TROJ_GEN.R011C0DF520
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Vebzenpak.vpa
BitDefender	Trojan.GenericKD.43284836
NANO-Antivirus	Trojan.Win32.Dwn.hlicca
ViRobot	Trojan.Win32.Guloader.126976.C
Ad-Aware	Trojan.GenericKD.43284836
Emsisoft	Trojan.GenericKD.43284836 (B)
Comodo	Malware@#2h2c8fz6zgzu3
F-Secure	Trojan.TR/Injector.kdjhy
BitDefenderTheta	Gen:NN.ZevbaF.34138.hm0@aKZ6onfb
VIPRE	Trojan.Win32.Generic!BT
Sophos	Mal/Generic-S
Avira	TR/Injector.kdjhy
Antiy-AVL	Trojan/Win32.Vebzenpak
Microsoft	PWS:Win32/Fareit.AB!MTB
Endgame	malicious (high confidence)
AegisLab	Trojan.Multi.Generic.4!c
ZoneAlarm	Trojan.Win32.Vebzenpak.vpa
GData	Trojan.GenericKD.43284836
Cynet	Malicious (score: 85)
AhnLab-V3	Malware/Win32.RL_Generic.R339532
ALYac	Trojan.GenericKD.43284836
MAX	malware (ai score=83)
Malwarebytes	Trojan.GuLoader
ESET-NOD32	a variant of Win32/Injector.EMGS
TrendMicro-HouseCall	TROJ_GEN.R011C0DF520
Tencent	Win32.Trojan.Vebzenpak.Akyn
Yandex	Trojan.Igent.bTQYtx.11
Ikarus	Trojan.VB.Crypt
Fortinet	W32/EMGS!tr
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:Trojan-gen
Qihoo-360	Generic/HEUR/QVM03.0.AFC8.Malware.Gen