1.5
低危
DACN
0.14
FACILE
1.00
IMCLNet
0.68
MFGraph
0.00
反病毒引擎
未检测
暂无反病毒引擎检测结果
静态指标
查询计算机名称
(2 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545283.516 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
|
1727545283.875 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(1 个事件)
| section | DATA |
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(20 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\jezxr.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\jezxr.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\jezxr.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2013-10-11 11:17:02
PE Imphash
b80b9adb041fd6c710660590b7c5f60c
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00008200 | 0x00000800 | 2.338179657765769 |
| DATA | 0x0000a000 | 0x00004a00 | 0x00001c00 | 4.7159842070158655 |
| .rsrc | 0x0000f000 | 0x000059f0 | 0x00005a00 | 3.8668638463372313 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_MENU | 0x0000f1d2 | 0x00000137 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MENU | 0x0000f1d2 | 0x00000137 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_BITMAP | 0x0000f309 | 0x00003044 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x0001234d | 0x000025a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x000148f5 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library iprop.dll:
• 0x40a000 PropVariantCopy
Library msi.DLL:
• 0x40a008 MsiDatabaseExportW
• 0x40a00c MsiDatabaseGetPrimaryKeysA
• 0x40a010 MsiDatabaseGetPrimaryKeysW
• 0x40a014 MsiDatabaseIsTablePersistentW
• 0x40a018 MsiDatabaseMergeA
• 0x40a01c MsiDatabaseMergeW
• 0x40a020 MsiDatabaseOpenViewA
• 0x40a024 MsiDatabaseOpenViewW
• 0x40a028 MsiDecomposeDescriptorA
• 0x40a02c MsiDecomposeDescriptorW
• 0x40a030 MsiDeleteUserDataA
• 0x40a034 MsiDeleteUserDataW
• 0x40a038 MsiDetermineApplicablePatchesA
• 0x40a03c MsiDeterminePatchSequenceA
• 0x40a040 MsiDeterminePatchSequenceW
• 0x40a044 MsiDoActionA
• 0x40a048 MsiDoActionW
• 0x40a04c MsiEnableLogA
• 0x40a050 MsiEnableLogW
• 0x40a054 MsiEnableUIPreview
• 0x40a058 MsiEnumClientsA
• 0x40a05c MsiEnumClientsW
• 0x40a060 MsiEnumComponentCostsA
• 0x40a064 MsiEnumComponentCostsW
• 0x40a068 MsiEnumComponentsA
• 0x40a06c MsiEnumComponentsW
• 0x40a070 MsiEnumFeaturesA
• 0x40a074 MsiEnumFeaturesW
• 0x40a078 MsiEnumPatchesA
• 0x40a07c MsiEnumPatchesExA
• 0x40a080 MsiEnumPatchesExW
Library kernel32.dll:
• 0x40a088 MapViewOfFileEx
• 0x40a08c GetACP
• 0x40a090 GetSystemDirectoryA
• 0x40a094 LocalFree
• 0x40a098 SetConsoleTitleW
• 0x40a09c EnumCalendarInfoW
• 0x40a0a0 GetFileSize
• 0x40a0a4 ReadFile
• 0x40a0a8 _lopen
Library adsldpc.dll:
• 0x40a0c0 ADSIFreeColumn
• 0x40a0c4 ADSIGetColumn
• 0x40a0c8 ADSIGetFirstRow
• 0x40a0cc ADSIGetNextColumnName
• 0x40a0d0 ADSIGetNextRow
• 0x40a0d4 ADSIGetObjectAttributes
• 0x40a0d8 ADSIGetPreviousRow
• 0x40a0dc ADSIModifyRdn
Library msrating.dll:
• 0x40a0e4 RatingCustomInit
Library MTXCLU.DLL:
• 0x40a0ec MtxCluIsClusterPresent
Library SAMLIB.dll:
• 0x40a0f4 SamAddMemberToAlias
L!This program cannot be run in DOS mode.
vsRich
GJuPjdh
MvPjdh
JRhr.dlhduse\
IuX[YZa`
PropVariantCopy
iprop.dll
MsiDatabaseExportW
MsiDatabaseGetPrimaryKeysA
MsiDatabaseGetPrimaryKeysW
MsiDatabaseIsTablePersistentW
MsiDatabaseMergeA
MsiDatabaseMergeW
MsiDatabaseOpenViewA
MsiDatabaseOpenViewW
MsiDecomposeDescriptorA
MsiDecomposeDescriptorW
MsiDeleteUserDataA
MsiDeleteUserDataW
MsiDetermineApplicablePatchesA
MsiDeterminePatchSequenceA
MsiDeterminePatchSequenceW
MsiDoActionA
MsiDoActionW
MsiEnableLogA
MsiEnableLogW
MsiEnableUIPreview
MsiEnumClientsA
MsiEnumClientsW
MsiEnumComponentCostsA
MsiEnumComponentCostsW
MsiEnumComponentsA
MsiEnumComponentsW
MsiEnumFeaturesA
MsiEnumFeaturesW
MsiEnumPatchesA
MsiEnumPatchesExA
MsiEnumPatchesExW
msi.DLL
MapViewOfFileEx
GetACP
GetSystemDirectoryA
LocalFree
SetConsoleTitleW
EnumCalendarInfoW
GetFileSize
ReadFile
_lopen
kernel32.dll
DTC_XaOpen
DTC_XaPrepare
DTC_XaRollback
MSDTCPRX.dll
ADSIFreeColumn
ADSIGetColumn
ADSIGetFirstRow
ADSIGetNextColumnName
ADSIGetNextRow
ADSIGetObjectAttributes
ADSIGetPreviousRow
ADSIModifyRdn
adsldpc.dll
RatingCustomInit
msrating.dll
MtxCluIsClusterPresent
MTXCLU.DLL
SamAddMemberToAlias
SAMLIB.dll
*X?NQ=Ye*.i
LW3VqN]n,D3+w@b:
Q6v7o:53=
8xWTTb
aDM%0^
LKboza~\Z^1
~TBbiTN\
uy"9! .
Z:t3$0
Kw**p!
/+zu3V
0;c`a%
l7,5(M
i0fqtdI
3Rt vy
IIg???K<??IK????
SC`6??
HJ_IK<??s
PIK<??q
x;/IK<??y
mIK<??e
IK<??{
"IK??}
-I !IK
?{ScOK????
'??Um_m
gK>??iKZ>??
giK>??
kiK>??Ue
'??UiK??
?g}U !U[ <
IqIUKE??[
???w[C???aY??a 7
OK>??a_+a[IK??w_}???Iw_9?[
yeKI???
o_Mo?[
_>I???
eskkIw 7IM3M_=Mo_=ofw_5w
S??S\5??
-7T{"@
-/Dz]&M
-3Bz@^
-3{@_-&M
-+Ku???
'???993
%V}???xm???do???D}???C
?7??K=
?7??=-?7??qq
;??5NH
?7??K=
?7??=-?7??qq
!"#$%&'()*+,-./0123456789:;<=>?@AD
Hdx+S|d_
KElT{/dq
h(^ratK\@uMs7"h
^hZv)z
`:ZUE>#y]
8!2ECab`EER
sy<u)xf?
`_D1Dabi
)mv0oG-Gfz5KY \]A2
G1yU;,^iBA6\?EA
A03UI8
Xy!r{+++
w.u zrbT
R-`dk<
G_&`C[W
9UEVIJTi
Q4?EGW[
SPrUKgkM
B)#Dk`:ZRz(#t7
:~{8VHj<my
{F=J1\-f
m`@Py:hrw
]%Ab@~'*lK
olv\*w}h
je)\Yv@U
TlTfM14vsA6x
omOXwCQA
R0~C WW]
LD$a|r
MD@]B)e
`nT6q+0
@or|]jv
_+%S:G
Ifi(i-V"4M''
{`de.E<K
E{5^[\[c'
&x?H:b\y
FJ>ZhHT>)],x=
F^ OY#
Vb066n"^
0HXFQ4n$
Sao8#V22
N#{Dm-(
8^BJ\y'9$
lP"KI)N
+"=,T}:TD8:(
9?YZUv%2n.B9W ).Yq
n/ GXQ~?
3X) ">
UW6t+yr
]GERk2^<aJP)~?CA
dlvs8xR
;9HxkYJ
2tgbDS
-'2,?c
V4Nu#,
W` Hz\Ya
=" {?@6j6MR=
7l*e8_
[<*nb8
7H=:=YUk-z
<DXR^sr
.@?}/M
XhflS`8k
d}1E%0;]
z$:]U_^2t
'TI1@wZ
JaTDs[8
4^)?5a
T0Z$K 3kjPMgl9
]eUXf\ZE/qQ{`.
4$ivdRrcY=
3 }13ph[z<_5YP
pDjHB}?9:6h/
E&5yDYdi&
Apft=&n2
C,mJ.[_
~XG-opC]:
plh'56"XURtN
x$t, d+
EB63njV}
=Ch$$$
Xur$$$
f0xf$$$
!vv$$$
BhB$$$
H!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T!T
N!S!S!S!S!S!S!S!S S!S!S!S!S S S S!U!S!S S!S!S!S!S!S!S!S!S!S!S
#Z#Z Q$$$
Q*_*_*_*_*_*_*_*_*_*_t*_*_#V#V']*_*_*_*_*_*_*_!S$$$
#Y/`/`/`/`/`/`/`/`Lp/`/`.b/`/`/`/`/`/`/`/`/`#Y$$$
*_5h5h5h5h5h5h5h5h5hf5h5hx5h5h5h5h5h5h5h5h5h5h5h5h*_$$$
1e:k:k:k:k:k:k:k:kg:kg:k:k1e1e:k:k:k:k:k:k:k:k1e$$$
:k?m?m?m?m?m?m?m?m?m~?m?m?m?m?m?m?m?m?m:k$$$
?mFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFqFq?m$$$
HvJuFqFqFqJuJuJuJuJuJuJuJuJuJuJuJuJuJuJuJuJuFqFqFqFqFqFqJuJuJuHv$$$
HvHvooooooooooooooooooooooooooooHvOz$$$
W F F F E E E E D
C : \ U s e r s \ a \ D o c u m e n t s \ i n v o i c e _ 4 4 7 5 8 9 5 4 5 \ i n v o i c e _ 4 4 7 5 8 9 5 4 5 . e x e
C : \ 1 3 5 4 c 6 0 3 d 4 0 2 b b 5 e 4 e d 8 4 1 9 0 9 d b 4 7 9 2 0 0 d b 9 2 6 6 0 6 0 4 1 7 d d b 1 d 0 5 8 f e 5 5 1 1 e 9 7 4 8
C : \ e 9 6 1 1 f 1 b 7 9 1 d 0 b 2 e 2 6 d 9 b f 0 6 5 4 5 6 0 4 a 7 0 8 2 c 9 3 2 0 d 7 9 0 9 7 a 3 0 e a 9 b c b 6 a b 6 1 1 8 f 9
C : \ D M a D r i i 8 . e x e
C : \ _ 2 m T V B I 9 . e x e
C : \ X f b I z a z 4 . e x e
C : \ r i Z N u K o E . e x e
C : \ s H m a P 9 n I . e x e
C : \ h N V 9 E _ D W . e x e
C : \ G 2 E m D i 8 q . e x e
C : \ 5 Q j V b t s S . e x e
C : \ 3 r p 0 k N V b . e x e
C : \ p u 7 n M 1 s c . e x e
C : \ 5 q n d b S K c . e x e
C : \ W 5 F g K p T U . e x e
C : \ p O E 8 p b A M . e x e
C : \ V M V L C u 2 L . e x e
C : \ k b 3 R S j S 1 . e x e
C : \ c u 2 i U y a e . e x e
C : \ m y S 6 c x B k . e x e
C : \ 1 5 1 c c 1 3 b a a d 8 7 1 2 d 7 0 4 c d 2 0 2 1 9 f 7 a c d 4 a 2 1 6 1 9 8 f 0 9 0 a 1 3 a 7 1 a d 6 7 b a b 0 8 d 5 9 3 a 2
C : \ 8 3 W 4 5 J i B . e x e
C : \ _ W e G b h 9 Z . e x e
C : \ M 2 R f Z y H 9 . e x e
C : \ o Q 5 H 9 U A 0 . e x e
C : \ g X W s N B o p . e x e
C : \ y I l K H x d W . e x e
C : \ u s B w h b 7 v . e x e
C : \ 2 B A X o w d H . e x e
C : \ I p v F p o Z y . e x e
C : \ i B P g U r g m . e x e
C : \ 7 8 b 2 b 9 6 c 6 8 3 e f 6 e 1 e b 1 9 b d 7 c a e d e c d b 1 4 e 3 a 5 a b 2 a 8 0 1 d 9 9 d a 4 f 8 6 f a 7 f 0 3 7 4 a 6 0
C : \ n n Q P C X x 5 . e x e
C : \ 4 8 8 4 1 6 c 3 c 1 e a 1 a 6 7 c 0 f a d 8 6 9 7 d 4 1 d 2 0 b a 0 4 8 d b 9 a e 8 c 1 4 0 1 b 5 0 2 e 8 0 5 f d 1 f 3 b 3 e d
C : \ g 0 m A g o y f . e x e
C : \ k L e h F u P 2 . e x e
C : \ k 3 A _ o 1 6 s . e x e
C : \ _ n 5 F h H 2 V . e x e
C : \ m F P h A y K P . e x e
C : \ i R P c m a 9 s . e x e
C : \ s z 2 C e j v v . e x e
C : \ e a 3 a 3 1 9 6 0 3 5 8 d 2 7 0 a 0 8 7 b c 6 7 6 7 3 8 9 9 a 2 4 1 8 2 e 6 1 4 b a 9 8 0 4 1 9 f 3 5 5 f 7 d d 2 7 4 3 c 3 e d
C : \ w 1 o X 7 N m _ . e x e
C : \ x k A 2 V y Y R . e x e
C : \ 8 4 b Z B f M h . e x e
C : \ U s e r s \ A d m i n i s t r a t o r \ A p p D a t a \ L o c a l \ T e m p \ c u c k o o - b 5 a e c 8 a 4 2 5 a d 5 e 6 f f 8 1 a e 2 a e 8 6 7 d 9 2 e f e b 7 8 3 e f d 8 7 3 b d 9 5 5 4 a 7 1 c 4 6 d 9 0 9 0 a 4 f 4 . e x e
C : \ l x a 6 T i 3 X . e x e
C : \ b 0 1 v Y 3 u 7 . e x e
C : \ e c b e 3 d 5 e 1 3 5 9 a d 1 a 3 d 3 8 3 e 7 d 8 5 a 6 1 e f d 2 2 a a 6 7 e 1 3 c 8 b 4 3 7 9 6 f a 9 d e 2 2 4 0 9 d 9 7 d 5
C : \ 7 e d 8 6 5 4 4 8 1 c 3 2 6 6 9 8 8 9 3 1 3 f 9 f 4 c 7 5 4 e 9 d 1 2 7 f 9 4 6 a 3 c c d 7 a b 2 c f c d 2 2 5 6 8 9 4 d c 3 1
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ j e z x r . p e 3 2
C : \ 7 d d 6 b 0 d d a b 0 2 d d 9 0 d 9 7 6 8 f 1 e 0 4 e c d e 6 8 9 e 7 c b a 1 c c 1 4 4 8 a 7 a 6 d b 7 1 7 0 e 2 5 d f c 6 1 b
Process Tree
-
029f4f8b9ce0f45b1432efbb7201b76deeefa07196306926f98aa8f65c619bac.exe (616)
"C:\Users\Administrator\AppData\Local\Temp\029f4f8b9ce0f45b1432efbb7201b76deeefa07196306926f98aa8f65c619bac.exe"
- jezxr.exe (1404) "C:\Users\ADMINI~1\AppData\Local\Temp\jezxr.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 3d2e3bcd53ad219e_jezxr.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\jezxr.exe |
| Size | 35.6KB |
| Processes | 616 (029f4f8b9ce0f45b1432efbb7201b76deeefa07196306926f98aa8f65c619bac.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 69ac574631a71b7d3a8d43eaa1972fc7 |
| SHA1 | 715e03c73079a065b1c5c94559405e30e2907bff |
| SHA256 | 3d2e3bcd53ad219e40e2aa20ce2c4444bd6876c7204aabd04b765736c11817e2 |
| CRC32 | 6E655326 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.