SmartHawk

5.4

中危

52 个模型检测该样本为恶意！

重新分析

下载样本

9158c49c3290af1d679a6327f6fd688b0758f727cfb55fcd57e5e0bffa7c5880

f05019af93c5128be58f0f54faf2f5d9.exe

分析耗时

76s

最近分析

文件大小

332.0KB

静态报毒动态报毒 100% AI SCORE=84 AIDETECTVM CLASSIC CONFIDENCE DZWR EMOTEPMF EMOTET GCNR GENCIRC GENERICKDZ GENETIC HIGH CONFIDENCE HTLFEV MALWARE2 MALWARE@#2Y89DQP9YTDRV R + TROJ R349336 S15608652 SCORE SUSPICIOUS PE THIAIBO UNSAFE WACATAC ZRGYX 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Emotet-FRW!F05019AF93C5	20201023	6.0.6.653
CrowdStrike	win/malicious_confidence_100% (W)	20190702	1.0
Alibaba	Trojan:Win32/Emotet.31a092e3	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20201023	18.4.3895.0
Tencent	Malware.Win32.Gencirc.10cdf572	20201023	1.0.0.1
Kingsoft		20201023	2013.8.14.323

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619999700.22511 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619999685.02211 CryptGenKey	crypto_handle: 0x0060cec8 algorithm_identifier: 0x0000660e () provider_handle: 0x0060c4e0 flags: 1 key: f9Oy~à-úuÓ&	success	1
1619999700.24111 CryptExportKey	crypto_handle: 0x0060cec8 crypto_export_handle: 0x0060c5a8 buffer: f¤¼K<óé½¦n3Ý"Q+/{xÊ!ÂóêgX@»BR¤óY3DMsÏÌá§%;p4ÕÛê6fÛÙYËý¾¬×vCãn´WÞ_Øc ,Àáy blob_type: 1 flags: 64	success	1
1619999734.91311 CryptExportKey	crypto_handle: 0x0060cec8 crypto_export_handle: 0x0060c5a8 buffer: f¤5²¸ g6àt5XnTÕþåªScç²Rç<ÓõÀôzÛ¯>Ä)ÃÃ2ÄwôEõåÀSÍ:9CÝ1à,~P¡ÈqÙ¨»wëPÕ5{@Ö+ãÖ² blob_type: 1 flags: 64	success	1

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619999684.22511 NtAllocateVirtualMemory	process_identifier: 3044 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d50000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619999700.69411 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

f05019af93c5128be58f0f54faf2f5d9.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619999700.35011 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (3 个事件)

host	107.5.122.110
host	172.217.24.14
host	199.101.86.6

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619999703.25611 RegSetValueExA	key_handle: 0x000003a4 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619999703.25611 RegSetValueExA	key_handle: 0x000003a4 value: 0åUÄÐ?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619999703.25611 RegSetValueExA	key_handle: 0x000003a4 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619999703.25611 RegSetValueExW	key_handle: 0x000003a4 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619999703.25611 RegSetValueExA	key_handle: 0x000003bc value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619999703.25611 RegSetValueExA	key_handle: 0x000003bc value: 0åUÄÐ?× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619999703.25611 RegSetValueExA	key_handle: 0x000003bc value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619999703.28811 RegSetValueExW	key_handle: 0x000003a0 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

107.5.122.110:80

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 个事件)

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKDZ.69738
FireEye	Generic.mg.f05019af93c5128b
CAT-QuickHeal	Trojan.EmotePMF.S15608652
Qihoo-360	Win32/Trojan.fc8
McAfee	Emotet-FRW!F05019AF93C5
Cylance	Unsafe
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:Win32/Emotet.31a092e3
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
Arcabit	Trojan.Generic.D1106A
TrendMicro	Trojan.Win32.WACATAC.THIAIBO
Cyren	W32/Emotet.DZWR-4831
Symantec	Trojan.Emotet
APEX	Malicious
Avast	Win32:Trojan-gen
Kaspersky	Trojan-Banker.Win32.Emotet.gcnr
BitDefender	Trojan.GenericKDZ.69738
NANO-Antivirus	Trojan.Win32.Emotet.htlfev
Paloalto	generic.ml
ViRobot	Trojan.Win32.Emotet.339968.C
Tencent	Malware.Win32.Gencirc.10cdf572
Ad-Aware	Trojan.GenericKDZ.69738
TACHYON	Banker/W32.Emotet.339968.H
Emsisoft	Trojan.Emotet (A)
Comodo	Malware@#2y89dqp9ytdrv
DrWeb	Trojan.Emotet.1005
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-R + Troj/Emotet-CLT
McAfee-GW-Edition	BehavesLike.Win32.Emotet.fh
Sophos	Troj/Emotet-CLT
Ikarus	Trojan-Banker.Emotet
Jiangmin	Trojan.Banker.Emotet.ofo
Avira	TR/Emotet.zrgyx
Antiy-AVL	Trojan[Banker]/Win32.Emotet
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
AegisLab	Trojan.Win32.Generic.4!c
ZoneAlarm	Trojan-Banker.Win32.Emotet.gcnr
GData	Trojan.GenericKDZ.69738
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Emotet.R349336
ALYac	Trojan.Agent.Emotet
MAX	malware (ai score=84)
Malwarebytes	Trojan.MalPack.TRE
ESET-NOD32	Win32/Emotet.CD
Rising	Trojan.Emotet!1.CB4A (CLASSIC)
SentinelOne	DFI - Suspicious PE
Fortinet	W32/Emotet.6DC5!tr

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-26 14:32:13

Imports

Library KERNEL32.dll:

• 0x42c0a0 WriteFile

• 0x42c0a4 SetFilePointer

• 0x42c0a8 FlushFileBuffers

• 0x42c0ac GetCurrentProcess

• 0x42c0b0 SetErrorMode

• 0x42c0b4 RtlUnwind

• 0x42c0b8 HeapAlloc

• 0x42c0bc HeapFree

• 0x42c0c0 HeapReAlloc

• 0x42c0c4 VirtualAlloc

• 0x42c0c8 GetSystemTimeAsFileTime

• 0x42c0cc GetCommandLineA

• 0x42c0d0 GetProcessHeap

• 0x42c0d4 GetStartupInfoA

• 0x42c0d8 RaiseException

• 0x42c0dc HeapSize

• 0x42c0e0 TerminateProcess

• 0x42c0e4 ReadFile

• 0x42c0e8 SetUnhandledExceptionFilter

• 0x42c0ec IsDebuggerPresent

• 0x42c0f0 VirtualFree

• 0x42c0f4 HeapDestroy

• 0x42c0f8 HeapCreate

• 0x42c0fc GetStdHandle

• 0x42c100 GetACP

• 0x42c104 LCMapStringA

• 0x42c108 LCMapStringW

• 0x42c10c FreeEnvironmentStringsA

• 0x42c110 GetEnvironmentStrings

• 0x42c114 FreeEnvironmentStringsW

• 0x42c118 GetEnvironmentStringsW

• 0x42c11c SetHandleCount

• 0x42c120 GetFileType

• 0x42c124 QueryPerformanceCounter

• 0x42c128 GetTickCount

• 0x42c12c GetStringTypeA

• 0x42c130 GetStringTypeW

• 0x42c134 GetConsoleCP

• 0x42c138 GetConsoleMode

• 0x42c13c SetStdHandle

• 0x42c140 WriteConsoleA

• 0x42c144 GetConsoleOutputCP

• 0x42c148 WriteConsoleW

• 0x42c14c WritePrivateProfileStringA

• 0x42c150 GetThreadLocale

• 0x42c154 GetOEMCP

• 0x42c158 GetCPInfo

• 0x42c15c InterlockedIncrement

• 0x42c160 TlsFree

• 0x42c164 DeleteCriticalSection

• 0x42c168 LocalReAlloc

• 0x42c16c TlsSetValue

• 0x42c170 TlsAlloc

• 0x42c174 InitializeCriticalSection

• 0x42c178 GlobalHandle

• 0x42c17c GlobalReAlloc

• 0x42c180 EnterCriticalSection

• 0x42c184 TlsGetValue

• 0x42c188 LeaveCriticalSection

• 0x42c18c LocalAlloc

• 0x42c190 GlobalFlags

• 0x42c194 GetCurrentProcessId

• 0x42c198 GetCurrentThread

• 0x42c19c ConvertDefaultLocale

• 0x42c1a0 GetModuleFileNameA

• 0x42c1a4 EnumResourceLanguagesA

• 0x42c1a8 GetLocaleInfoA

• 0x42c1ac lstrcmpA

• 0x42c1b0 InterlockedDecrement

• 0x42c1b4 GetModuleFileNameW

• 0x42c1b8 FormatMessageA

• 0x42c1bc LocalFree

• 0x42c1c0 MulDiv

• 0x42c1c4 GlobalGetAtomNameA

• 0x42c1c8 GlobalAddAtomA

• 0x42c1cc GlobalFindAtomA

• 0x42c1d0 GlobalDeleteAtom

• 0x42c1d4 SetLastError

• 0x42c1d8 lstrcmpW

• 0x42c1dc GetModuleHandleA

• 0x42c1e0 GetProcAddress

• 0x42c1e4 GetVersionExA

• 0x42c1e8 GlobalFree

• 0x42c1ec FreeResource

• 0x42c1f0 ExitProcess

• 0x42c1f4 OpenMutexA

• 0x42c1f8 OpenEventA

• 0x42c1fc SetEvent

• 0x42c200 ReleaseMutex

• 0x42c204 WaitForSingleObject

• 0x42c208 IsBadReadPtr

• 0x42c20c GetCurrentThreadId

• 0x42c210 OpenFileMappingA

• 0x42c214 CreateFileA

• 0x42c218 MapViewOfFile

• 0x42c21c UnmapViewOfFile

• 0x42c220 CloseHandle

• 0x42c224 FlushViewOfFile

• 0x42c228 GetWindowsDirectoryA

• 0x42c22c LoadLibraryA

• 0x42c230 FreeLibrary

• 0x42c234 WinExec

• 0x42c238 lstrlenA

• 0x42c23c CompareStringA

• 0x42c240 GetVersion

• 0x42c244 GetLastError

• 0x42c248 MultiByteToWideChar

• 0x42c24c InterlockedExchange

• 0x42c250 Sleep

• 0x42c254 GlobalAlloc

• 0x42c258 GlobalLock

• 0x42c25c GlobalUnlock

• 0x42c260 WideCharToMultiByte

• 0x42c264 FindResourceA

• 0x42c268 LoadResource

• 0x42c26c LockResource

• 0x42c270 UnhandledExceptionFilter

• 0x42c274 SizeofResource

Library USER32.dll:

• 0x42c2a0 TranslateMessage

• 0x42c2a4 GetMessageA

• 0x42c2a8 GetWindowThreadProcessId

• 0x42c2ac GetSysColorBrush

• 0x42c2b0 UnregisterClassA

• 0x42c2b4 DrawTextA

• 0x42c2b8 TabbedTextOutA

• 0x42c2bc ShowWindow

• 0x42c2c0 MoveWindow

• 0x42c2c4 SetWindowTextA

• 0x42c2c8 IsDialogMessageA

• 0x42c2cc SetMenuItemBitmaps

• 0x42c2d0 GetMenuCheckMarkDimensions

• 0x42c2d4 LoadBitmapA

• 0x42c2d8 ModifyMenuA

• 0x42c2dc GetMenuState

• 0x42c2e0 EnableMenuItem

• 0x42c2e4 CheckMenuItem

• 0x42c2e8 SendDlgItemMessageA

• 0x42c2ec WinHelpA

• 0x42c2f0 GetCapture

• 0x42c2f4 SetWindowsHookExA

• 0x42c2f8 CallNextHookEx

• 0x42c2fc GetClassLongA

• 0x42c300 GetClassNameA

• 0x42c304 SetPropA

• 0x42c308 GetPropA

• 0x42c30c RemovePropA

• 0x42c310 GetFocus

• 0x42c314 SetFocus

• 0x42c318 ValidateRect

• 0x42c31c GetWindowTextA

• 0x42c320 GetForegroundWindow

• 0x42c324 GetLastActivePopup

• 0x42c328 DispatchMessageA

• 0x42c32c GetTopWindow

• 0x42c330 UnhookWindowsHookEx

• 0x42c334 GetMessageTime

• 0x42c338 PeekMessageA

• 0x42c33c TrackPopupMenu

• 0x42c340 GetKeyState

• 0x42c344 SetForegroundWindow

• 0x42c348 IsWindowVisible

• 0x42c34c UpdateWindow

• 0x42c350 GetMenu

• 0x42c354 PostMessageA

• 0x42c358 GetMenuItemID

• 0x42c35c GetMenuItemCount

• 0x42c360 MessageBoxA

• 0x42c364 GetClassInfoExA

• 0x42c368 GetClassInfoA

• 0x42c36c RegisterClassA

• 0x42c370 AdjustWindowRectEx

• 0x42c374 CopyRect

• 0x42c378 GetDlgCtrlID

• 0x42c37c DefWindowProcA

• 0x42c380 CallWindowProcA

• 0x42c384 SetWindowPos

• 0x42c388 SystemParametersInfoA

• 0x42c38c GetWindowPlacement

• 0x42c390 GetWindow

• 0x42c394 GetDesktopWindow

• 0x42c398 GetActiveWindow

• 0x42c39c SetActiveWindow

• 0x42c3a0 CreateDialogIndirectParamA

• 0x42c3a4 EnableWindow

• 0x42c3a8 CloseClipboard

• 0x42c3ac OpenClipboard

• 0x42c3b0 SetClipboardData

• 0x42c3b4 EmptyClipboard

• 0x42c3b8 DestroyWindow

• 0x42c3bc GetWindowLongA

• 0x42c3c0 GetDlgItem

• 0x42c3c4 IsWindowEnabled

• 0x42c3c8 GetNextDlgTabItem

• 0x42c3cc EndDialog

• 0x42c3d0 LoadIconA

• 0x42c3d4 IsIconic

• 0x42c3d8 GetSystemMenu

• 0x42c3dc AppendMenuA

• 0x42c3e0 DrawIcon

• 0x42c3e4 CreateWindowExA

• 0x42c3e8 InSendMessage

• 0x42c3ec PostQuitMessage

• 0x42c3f0 DestroyMenu

• 0x42c3f4 GetCursorPos

• 0x42c3f8 WindowFromPoint

• 0x42c3fc EndPaint

• 0x42c400 BeginPaint

• 0x42c404 ClientToScreen

• 0x42c408 GrayStringA

• 0x42c40c GetWindowTextLengthA

• 0x42c410 DrawTextExA

• 0x42c414 SetCursor

• 0x42c418 PtInRect

• 0x42c41c InflateRect

• 0x42c420 SendMessageA

• 0x42c424 GetWindowRect

• 0x42c428 GetClientRect

• 0x42c42c ScreenToClient

• 0x42c430 GetDC

• 0x42c434 ReleaseDC

• 0x42c438 InvalidateRect

• 0x42c43c RedrawWindow

• 0x42c440 SetTimer

• 0x42c444 KillTimer

• 0x42c448 GetParent

• 0x42c44c GetSystemMetrics

• 0x42c450 LoadMenuA

• 0x42c454 GetSubMenu

• 0x42c458 DrawFocusRect

• 0x42c45c RegisterWindowMessageA

• 0x42c460 SetWindowLongA

• 0x42c464 CopyIcon

• 0x42c468 DestroyCursor

• 0x42c46c MessageBeep

• 0x42c470 IsWindow

• 0x42c474 GetSysColor

• 0x42c478 GetMessagePos

• 0x42c47c LoadCursorA

• 0x42c480 MapWindowPoints

Library GDI32.dll:

• 0x42c028 SelectObject

• 0x42c02c SetViewportOrgEx

• 0x42c030 OffsetViewportOrgEx

• 0x42c034 SetViewportExtEx

• 0x42c038 ScaleViewportExtEx

• 0x42c03c SetWindowExtEx

• 0x42c040 ScaleWindowExtEx

• 0x42c044 DeleteDC

• 0x42c048 Escape

• 0x42c04c ExtTextOutA

• 0x42c050 TextOutA

• 0x42c054 RectVisible

• 0x42c058 PtVisible

• 0x42c05c DeleteObject

• 0x42c060 SetMapMode

• 0x42c064 SetBkMode

• 0x42c068 RestoreDC

• 0x42c06c SaveDC

• 0x42c070 GetDeviceCaps

• 0x42c074 CreateBitmap

• 0x42c078 SetBkColor

• 0x42c07c SetTextColor

• 0x42c080 GetClipBox

• 0x42c084 GetCharWidthA

• 0x42c088 GetTextMetricsA

• 0x42c08c GetTextExtentPoint32A

• 0x42c090 GetStockObject

• 0x42c094 GetObjectA

• 0x42c098 CreateFontIndirectA

Library WINSPOOL.DRV:

• 0x42c488 ClosePrinter

• 0x42c48c DocumentPropertiesA

• 0x42c490 OpenPrinterA

Library ADVAPI32.dll:

• 0x42c000 RegSetValueExA

• 0x42c004 RegCreateKeyExA

• 0x42c008 RegEnumKeyA

• 0x42c00c RegDeleteKeyA

• 0x42c010 RegQueryValueExA

• 0x42c014 RegOpenKeyA

• 0x42c018 RegOpenKeyExA

• 0x42c01c RegQueryValueA

• 0x42c020 RegCloseKey

Library SHELL32.dll:

• 0x42c28c ShellExecuteA

Library SHLWAPI.dll:

• 0x42c294 PathFindFileNameA

• 0x42c298 PathFindExtensionA

Library OLEAUT32.dll:

• 0x42c27c VariantClear

• 0x42c280 VariantChangeType

• 0x42c284 VariantInit

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.