1.1
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.62
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | Trojan:Win32/Miancha.b2fd906c | 20190527 | 0.3.0.5 |
| Avast | Win32:Simbot-A [Trj] | 20240328 | 23.9.8494.0 |
| Baidu | Win32.Trojan.Inject.bm | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20231026 | 1.0 |
| Kingsoft | malware.kb.a.1000 | 20230906 | None |
| McAfee | Downloader-BIJ.a | 20240327 | 6.0.6.653 |
| Tencent | Trojan.Win32.Miancha.za | 20240328 | 1.0.0.1 |
静态指标
动态指标
该二进制文件可能包含加密或压缩数据，表明使用了打包工具
(2 个事件)
| section | {'name': '.rsrc', 'virtual_address': '0x00005000', 'virtual_size': '0x00002cc4', 'size_of_data': '0x00003000', 'entropy': 7.732458338359274} | entropy | 7.732458338359274 | description | 发现高熵的节 | |||||||||
| entropy | 0.42857142857142855 | description | 此PE文件的整体熵值较高 | |||||||||||
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
文件已被 VirusTotal 上 67 个反病毒引擎识别为恶意
(50 out of 67 个事件)
| ALYac | Gen:Variant.Downloader.19 |
| APEX | Malicious |
| AVG | Win32:Simbot-A [Trj] |
| Acronis | suspicious |
| AhnLab-V3 | Backdoor/Win32.CSon.R885 |
| Alibaba | Trojan:Win32/Miancha.b2fd906c |
| Antiy-AVL | Trojan[Downloader]/Win32.Rubinurd.bf |
| Arcabit | Trojan.Downloader.19 |
| Avast | Win32:Simbot-A [Trj] |
| Avira | TR/Dropper.Gen |
| Baidu | Win32.Trojan.Inject.bm |
| BitDefender | Gen:Variant.Downloader.19 |
| BitDefenderTheta | AI:Packer.166E5CF91F |
| Bkav | W32.AIDetectMalware |
| CAT-QuickHeal | Trojan.Mauvaise.SL1 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.2c07af |
| Cylance | unsafe |
| Cynet | Malicious (score: 100) |
| DeepInstinct | MALICIOUS |
| DrWeb | Win32.HLLW.Autoruner.27746 |
| ESET-NOD32 | Win32/TrojanDownloader.Agent.PTT |
| Elastic | malicious (high confidence) |
| Emsisoft | Gen:Variant.Downloader.19 (B) |
| F-Secure | Trojan.TR/Dropper.Gen |
| FireEye | Generic.mg.efadcdd2c07af180 |
| Fortinet | W32/Injector.BFSU!tr |
| GData | Win32.Trojan.PSE1.13MYFBD |
| Detected | |
| Ikarus | Trojan-Downloader.Win32.Small |
| Jiangmin | TrojanDownloader.Small.akan |
| K7AntiVirus | Trojan-Downloader ( 0040f54b1 ) |
| K7GW | Trojan ( 0056e8c61 ) |
| Kaspersky | HEUR:Trojan.Win32.Miancha.gen |
| Kingsoft | malware.kb.a.1000 |
| Lionic | Trojan.Win32.Generic.lk0q |
| MAX | malware (ai score=89) |
| Malwarebytes | Generic.Malware.AI.DDS |
| MaxSecure | Trojan.Downloader.Rubinurd.bf |
| McAfee | Downloader-BIJ.a |
| MicroWorld-eScan | Gen:Variant.Downloader.19 |
| Microsoft | Trojan:Win32/Injector.ARA!MTB |
| NANO-Antivirus | Trojan.Win32.Small.bzqcm |
| Panda | Trj/Genetic.gen |
| Rising | Trojan.Injector!1.A7C6 (CLASSIC) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Downloader |
| Sangfor | Trojan.Win32.Save.a |
| SentinelOne | Static AI - Malicious PE |
| Skyhigh | BehavesLike.Win32.Downloader.nm |
| Sophos | Troj/DwnLdr-MDK |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2010-08-30 10:41:44
PE Imphash
bef229bd8a414afbbd1edba1aeb00206
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00001675 | 0x00002000 | 5.771088839251905 |
| .rdata | 0x00003000 | 0x00000665 | 0x00001000 | 2.4890534807960596 |
| .data | 0x00004000 | 0x00000517 | 0x00001000 | 0.9486905717992521 |
| .rsrc | 0x00005000 | 0x00002cc4 | 0x00003000 | 7.732458338359274 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_RCDATA | 0x000050b4 | 0x00002800 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_VERSION | 0x000078b4 | 0x00000410 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.dll:
• 0x40301c ReadFile
• 0x403020 HeapAlloc
• 0x403024 GetProcessHeap
• 0x403028 GetFileSize
• 0x40302c CreateFileA
• 0x403030 CopyFileA
• 0x403034 MoveFileExA
• 0x403038 GetTempFileNameA
• 0x40303c GetTempPathA
• 0x403040 GetModuleFileNameA
• 0x403044 LockResource
• 0x403048 LoadResource
• 0x40304c SizeofResource
• 0x403050 FindResourceA
• 0x403054 GetLastError
• 0x403058 lstrcpyA
• 0x40305c LeaveCriticalSection
• 0x403060 GetProcAddress
• 0x403064 ExitProcess
• 0x403068 EnterCriticalSection
• 0x40306c VirtualProtect
• 0x403070 InitializeCriticalSection
• 0x403074 GetModuleHandleA
• 0x403078 MoveFileA
• 0x40307c DeleteFileA
• 0x403080 lstrcmpiA
• 0x403084 GetLongPathNameA
• 0x403088 ExpandEnvironmentStringsA
• 0x40308c GetTickCount
• 0x403090 lstrlenA
• 0x403094 OutputDebugStringA
• 0x403098 TerminateProcess
• 0x40309c VirtualAllocEx
• 0x4030a0 HeapFree
• 0x4030a4 VirtualAlloc
• 0x4030a8 Sleep
• 0x4030ac WinExec
• 0x4030b0 SetFilePointer
• 0x4030b4 WriteFile
• 0x4030b8 CloseHandle
• 0x4030bc BeginUpdateResourceA
• 0x4030c0 UpdateResourceA
• 0x4030c4 lstrcatA
• 0x4030c8 EndUpdateResourceA
Library ADVAPI32.dll:
• 0x403000 CryptAcquireContextA
• 0x403004 CryptReleaseContext
• 0x403008 CloseServiceHandle
• 0x40300c EnumServicesStatusA
• 0x403010 OpenSCManagerA
• 0x403014 CryptGenRandom
Exports
| Ordinal | Address | Name |
|---|---|---|
| 1 | 0x4041d0 | szFile |
L!This program cannot be run in DOS mode.
.rdata
@.data
SVWj@3Y3j@fY3fj?3Y]fs
MSQEuPV
YYPV50@
ESPuW=0@
ESPuh9
;t$uuh
X^UQQV5
WEWP}}
;t'EPEPEPh
3?;3j u
X_^UQQe
A(;r3_^[
on12\}5'/
\E}W9_3D
3){ @K
_ve>OJ0S&
D8By/B
Lv")A~*
ZK<suAH
a.-0p;
vF5z!t'O
}Q#~`1Qf ekSB
"^So1#
>DpIa\ nIVz8fX(
}bY9<B2U =t%
8NV0aTbk
P]01g4
:p cn8.
|_^[]UE
x+Ss%WowHd
f"0Z.Ua]OgLI
$vR>`f]\;mfx`:
&<;yq%uX
\{^s56h5_R0j
KOn&%sHe~
R/TiNDp
(?5Q=Ou]n9;0BK
5IB*Gu5
DD4s"8S
/$`x26
q/^P*'}@B*X
;Bl(m:7$$=MRa*
C$v~.j
EE~cSVu
3fj@3Yj@fY3fj@3Yu
]f]@~)M
GEQ@9E|
3tESPPPPu
uRFGHt
t+t'NW8u
;uH_^Q=
DDDDDDDDDDDDDD
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
CloseHandle
WriteFile
SetFilePointer
ExitProcess
ReadFile
HeapAlloc
GetProcessHeap
GetFileSize
CreateFileA
CopyFileA
MoveFileExA
GetTempFileNameA
GetTempPathA
GetModuleFileNameA
LockResource
LoadResource
SizeofResource
FindResourceA
GetLastError
lstrcpyA
LeaveCriticalSection
GetProcAddress
lstrcatA
EnterCriticalSection
VirtualProtect
InitializeCriticalSection
GetModuleHandleA
MoveFileA
DeleteFileA
lstrcmpiA
GetLongPathNameA
ExpandEnvironmentStringsA
GetTickCount
lstrlenA
OutputDebugStringA
TerminateProcess
VirtualAllocEx
HeapFree
VirtualAlloc
WinExec
KERNEL32.dll
wsprintfA
MessageBeep
MessageBoxA
USER32.dll
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CloseServiceHandle
EnumServicesStatusA
OpenSCManagerA
ADVAPI32.dll
StrChrA
PathRemoveFileSpecA
SHLWAPI.dll
roudanx.exe
szFile
~:,"~dat
rwbinru/dyd
RT_RCDATA
szFile
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinHttp
ResumeThread
SetThreadContext
WriteProcessMemory
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
GetThreadContext
CreateProcessA
kernel32
ZwUnmapViewOfSection
Are you sure?
regedit.exe /s
~dfds3.reg
%tmp%\
Windows Registry Editor Version 5.00
"%s"="%s"
}][B/o*a
>trG=hwE6S
ck8x~D Dj0o
ug1XAI
pL$GIL
^Fs26,x#
Vu(jB<70r[
'UoXx+Dc\_F~
|9:y^L
pMFnS?R
Ms}8>]g
HD7dp@<
}qdtW"0n
4~@Yu
C byV"_%k~`UP3_%
C/RT]:Y
r;K%){1EHz
>0UU:lt&O{!P
_+u-aN\L /HOE
f6!,$Izu-~}2r
Py, dt-
Ie2&eu](&#e|0
zNDGCe@"
@[=f2.
@?@0P_:Y]C9
A1MAECt
0W=~X#K}
4${_Mn0[_~mm
E/'x_M(
J'(]J?
,dz5}[z
#{|I)~F?Ph/*<3B*\
PE+I.u
oAnw\hLV
%xh&)"E#LkX
d(x(W'V
)9I e[G
@0X1PUG%ncM
EyYMN{
[b-QvA
d$m,KZ(HRJZ{
`K;R4%qD
g_{6&s`
`{rv.MvU"Nv
l1@v29
}L3Rw-%oOR
Y%~ (LE
-d>n69<4
8aQ2>Ao
1}*1ed
y<\Y3]c
1=>%tk
v*`D.QJ':Kd?2
_v|tx
TL}/zN
?RKLhNM[^
~CZI,e
zNY:&~,
GS46s<2J)
e7migZ\!W
59]rR 2m
mslN'$
{khMXTj@YMFl>W
I0uxS5nnD
G=j01k3A2?
$f6H:$a
PN'm\+
o4j>}oi
-.J%!D&Hn{
tVbn 4L3
Ug6gc.<033
}_y;%niJ
D-hMT`Y
J2Jfpxj#d
$e`vuo
t2&OQc4U~p
+-5+cZJ%MMAJmT]
^\cgA%7m|nkW
G;HO7 <b
nDI:\m
9cqu2g0
2)tK^2:gg{M
eotoS/l
.m>ty\O
;,l(pi+dQ
>}QGXQ"w89`
%?|RdyBA
{|@%L$#%MD?
f8MC\z<=%(
?C81B<
JjU/=g
#">;psi4e*&
1!2MII1
djRK3n<eOe
|/~Y3x|<
iK/O-A}btGT
ph_cn=
K(({Fzb
mewBAY
Hr)Oe]!
$`;oj7
{t|1Yw(nlyO
=,xz(?lg4AENa1
O oo:,507z^
{wu9H$.bBooe
}~;:eR
|l6\d~
;2!tu2!
|'H#1Vai
N:(i@# 1@
OVh%uUXk@E
QHS`EtK
DssZIP6FEB'4d
nlk=a F^{__M
Ek.w6.
lG?mH']8F<
ZGZj:2(8?Z
o8yXcT
prLW_z
h/@g:D
UNU4vj
]D1@-lP4
`pN8hj~!>
}&rjsH^y"
U$?IeZM
,-\~v/uC`BcPj{AK(M
SJvWo#0
spVp/5cxSn%
#dSTf4n
Wc!o&>s
,WEB5L
"*3j?^oB
*n^OH7p
p$3an4
B2GH1R'
1P2tei|U-u08a
l<VWi`
LVwUFw
nc.sR=-O
t<u2gf!Z
+Lhj~r+
Og_de0w$a5iN
n[0p_$y
I !Y:!
e~D"[-
r0&G1ck}M*Y{dN=
(<RZfo
\7kz r
9k 1*vm
l/(=~w
_<#KC~_U!"pw X
fWv]&y
]5L\Yd[4/4.
(n970=r
;&%wmQ>db.<}anjt
<]UY/!VAy
<'p]=f
UK%A"!wn
'>l{F7
;"|k+tPQY^
'xFLf6.
g@AYFt47M9w
:POr%{
_JU'Xi/#
Jjw Ho!v\
7J$ijYt1(W c
A,ATu*h
r+L5q%
>fv"T`m
W$EG<@h
wJ4G8T2
o1w#(yy
uCKHkl3{
lF]+1]q
l6gdlg< "-
XQe^I#*&
"l/E v
hG&&t^
a`Fr:<
PADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
R T _ R C D A T A
V S _ V E R S I O N _ I N F O
S t r i n g F i l e I n f o
0 4 0 9 0 4 b 0
C o m p a n y N a m e
A d o b e S y s t e m s , I n c .
F i l e D e s c r i p t i o n
A d o b e ? F l a s h ? P l a y e r I n s t a l l e r / U n i n s t a l l e r 1 0 . 1 r 5 3
F i l e V e r s i o n
1 0 , 1 , 5 3 , 6 4
I n t e r n a l N a m e
A d o b e ? F l a s h ? P l a y e r I n s t a l l e r / U n i n s t a l l e r 1 0 . 1
L e g a l C o p y r i g h t
C o p y r i g h t ? 1 9 9 6 - 2 0 1 0 A d o b e , I n c .
L e g a l T r a d e m a r k s
A d o b e ? F l a s h ? P l a y e r
O r i g i n a l F i l e n a m e
F l a s h U t i l . e x e
P r o d u c t N a m e
F l a s h ? P l a y e r I n s t a l l e r / U n i n s t a l l e r
P r o d u c t V e r s i o n
1 0 , 1 , 5 3 , 6 4
V a r F i l e I n f o
T r a n s l a t i o n
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.