2.3
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.73
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Upatre-D [Cryp] | 20200425 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200426 | 2013.8.14.323 |
| McAfee | Downloader-FSH!F294F0C99F19 | 20200426 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b07783 | 20200426 | 1.0.0.1 |
静态指标
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\wsace.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\wsace.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\wsace.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(1 个事件)
| host | 114.114.114.114 | |||
查找已知的沙箱执行样本的文件路径
(1 个事件)
| file | C:\sample.exe |
文件已被 VirusTotal 上 62 个反病毒引擎识别为恶意
(50 out of 62 个事件)
| ALYac | Trojan.Ppatre.Gen.1 |
| APEX | Malicious |
| AVG | Win32:Upatre-D [Cryp] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Ppatre.Gen.1 |
| AhnLab-V3 | Trojan/Win32.Upatre.C3416947 |
| Antiy-AVL | Trojan[Spy]/Win32.Zbot |
| Arcabit | Trojan.Ppatre.Gen.1 |
| Avast | Win32:Upatre-D [Cryp] |
| Avira | TR/Crypt.XPACK.Gen |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Ppatre.Gen.1 |
| BitDefenderTheta | Gen:NN.ZexaF.34106.dqZ@auL@H2oi |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | Trojanspy.Zbot.8657 |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | TrojWare.Win32.Spy.Zbot.SWEG@5bj6da |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.99f19b |
| Cylance | Unsafe |
| Cyren | W32/Upatre.KB.gen!Eldorado |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.Ppatre.Gen.1 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Upatre.KB.gen!Eldorado |
| F-Secure | Trojan-Downloader:W32/Upatre.D |
| FireEye | Generic.mg.f294f0c99f19b1f1 |
| Fortinet | W32/Kryptik.GQIX!tr |
| GData | Trojan.Ppatre.Gen.1 |
| Ikarus | Trojan.Win32.Bublik |
| Invincea | heuristic |
| Jiangmin | TrojanSpy.Zbot.eeim |
| K7AntiVirus | Trojan-Downloader ( 0048f6391 ) |
| K7GW | Trojan-Downloader ( 0048f6391 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| MAX | malware (ai score=88) |
| Malwarebytes | Trojan.Agent.REW |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | Downloader-FSH!F294F0C99F19 |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.qt |
| MicroWorld-eScan | Trojan.Ppatre.Gen.1 |
| Microsoft | TrojanDownloader:Win32/Upatre |
| NANO-Antivirus | Trojan.Win32.Zbot.czktya |
| Panda | Generic Malware |
| Qihoo-360 | HEUR/QVM20.1.D173.Malware.Gen |
| Rising | Dropper.Generic!8.35E (TFE:dGZlOgL7fYCDv4oNJA) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Dropper |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
1992-01-17 12:30:14
PE Imphash
120333c7f5efe2cf1ca4b387c2c6ca58
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x000017a8 | 0x00001800 | 6.630599592253614 |
| .rdata | 0x00003000 | 0x00000416 | 0x00000600 | 3.182457728583783 |
| .data | 0x00004000 | 0x0000065c | 0x00000400 | 4.081855804944679 |
| .rsrc | 0x00005000 | 0x00001e10 | 0x00002000 | 3.67888743520045 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x000050f0 | 0x00001ca8 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_STRING | 0x00006db0 | 0x00000060 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00006d98 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library KERNEL32.DLL:
• 0x403018 HeapAlloc
• 0x40301c GetProcessHeap
• 0x403020 LoadLibraryW
• 0x403024 GetModuleHandleA
• 0x403028 CloseHandle
• 0x40302c GetCurrentThreadId
Library COMCTL32.dll:
• 0x403000 ImageList_Add
• 0x403004 None
• 0x403008 ImageList_Create
• 0x40300c ImageList_Destroy
• 0x403010 ImageList_AddMasked
Library USER32.dll:
• 0x403034 PostQuitMessage
• 0x403038 GetMessageA
• 0x40303c DispatchMessageA
• 0x403040 TranslateMessage
• 0x403044 CreateWindowExA
• 0x403048 RegisterClassExA
• 0x40304c DefWindowProcA
• 0x403050 SendMessageA
• 0x403054 SetWindowTextA
• 0x403058 GetActiveWindow
• 0x40305c TrackPopupMenu
L!This program cannot be run in DOS mode.
qHy'q&
qHy%q!
qHy#q&
qHy$q&
qRich'
`.rdata
@.data
^YQVVD$
tRVW|$
)+_^][
PjuhZ\
fold.html
userDefine.currenP @
@@@@@@
3PQPVj h
SWAVAf9
;wME;r
@@@@@@
@@@@@@@@@
P+5$0@
BBBBUE
tF]%L0@
AK}h'E$pJb
_Te=Bk}w.E9fKkn
rhb}n;13vKk
T"zKhXv-
i.f}{*E9fKij
Yn{~2E$vaiFn;r8vZO
D%DfwaH;
EV}Kbci;]V}Kbj~
r;T#v.M/
:GrQSZ
<DM{1BQeMmBC.
DM{A%J%C]
p\YVSM[
dM{GrU
^+zO.2
O@,1Vy
DGrYSZ
rAM[;GR1o[0
R{[mSz
;kS(|oBTDVB
$+BPg:@.
|cyV"X
1VJ1S-c
FC9kW'zA
lJ:.pl4;T/=V"
VcBf`5tK#|I7f{9
?Rx|.t
fqs&J_
:,F$l{|r
X+PQyY
TrackPopupMenu
GetActiveWindow
SetWindowTextA
SendMessageA
DefWindowProcA
RegisterClassExA
CreateWindowExA
TranslateMessage
DispatchMessageA
GetMessageA
PostQuitMessage
USER32.dll
GetCurrentThreadId
CloseHandle
GetModuleHandleA
LoadLibraryW
GetProcessHeap
HeapAlloc
KERNEL32.DLL
ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ImageList_Add
COMCTL32.dll
nectarine
name please
plucklife
somnolent
static
RichEdit
button
trigeder
reelese
welation
tinits
hidelism
@@@@@@@
YT&!XT
30302/
/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"/"*
, 1#1#1#1#1#1#1#1#/"1#1#1#1#/"/"/"1#1#1#/"1#1#1#1#1#1#1#1#1#1#,
.!2$2$2$2$2$2$2$2$2$2$2$2$ia2$2$2$2$2$2$2$2$2$2$2$2$.!
0"4%4%4%4%4%4%4%4%2$2$3$4%pg4%4%4%4%4%4%4%4%4%4%4%4%0"
1#5&5&5&5&5&5&5&5&5&5&ri5&5&3$3$4&5&5&5&5&5&5&5&1#
3%7'7'7'7'7'7'7'7'L=
7'7'7'7'7'z7'7'7'7'7'7'7'3%
5&8(8(8(8(8(8(8(8(8(bW8(8(ul8(8(8(8(8(8(8(8(8(8(8(8(5&
7'<,<,<,<,<,<,<,<,bX<,bX<,<,7'7':+<,<,<,<,<,<,<,7'
;+B2B2B2B2B2B2B2B2B2{rB2B2
B2B2B2B2B2B2B2;+
B2G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7G7B2
I9L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;L;I9
O?nbnbnbnbnbnbnbnbnbnbmcmcmcmcmcmcmcmcmcmcmcmcmcmcmcmcmcmcmcmcO?
L!This program cannot be run in DOS mode.
i2h:2h:2h:2i:gh::1h::3h:)%:"h:)%:Ph:)%:
h::3h::*h::3h::3h:Rich2h:
`.data
@.reloc
otools\inc\nlg\private\inc\msfsa\faarray_cont_t.h
otools\inc\nlg\private\inc\msfsa\falextools_t.h
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
CorExitProcess
bad exception
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
Unknown exception
GetProcessWindowStation
GetUserObjectInformationW
GetLastActivePopup
GetActiveWindow
MessageBoxW
!"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
nlg\lib\msfsa\faallocator.cpp
nlg\lib\msfsa\farsdfa_pack_triv.cpp
otools\inc\nlg\private\inc\msfsa\faarray_cont_2xresize_t.h
nlg\lib\msfsa\famultimap_pack.cpp
Internal error.
Object cannot be initialized.
Limit size has been exceeded.
Out of memory.
Object is not ready.
]ut5p?
W3+t#Hu7Vu
^3[UQE
V3WM0u
UVW39~
<|uCt7
t79V$t2h
M 3UE9J
MA3;~\U
E;}q}M
PE @PE
MPE+@PE
G;}|}]}$
F;}^U9]
z;~\;}T;]
Yt]U]U]
EVW3EP
r o g r a m i s f r e e s o f t w a r e ; y o u c a n r e d i s t r i b u t e i t a n d / o r m o d i f y i t u n d e r t h e
e r m s o f t h e G N U G e n e r a l P u b l i c L i c e n s e a s p u b l i s h e d b y t h e F r e e S o f
K e r n e l 3 2 . d l l
R i c h e d 3 2 . d l l
P a n e 1
P a n e 2
S t a n d a r d
C u s t o m i z e . . .
C : \ s a m p l e . e x e
C : \ 6 6 9 a 7 d 0 5 b 3 4 a 2 b e 8 b 8 0 8 f 2 d c 4 4 6 b f 9 5 7 e 1 e e 8 8 9 4 0 d a c e c b d c 1 9 a 7 b e 6 b d f 4 7 1 e 2
C : \ A a q G J R L X . e x e
C : \ 5 J j d h b X w . e x e
C : \ s 8 Z N n W V E . e x e
C : \ G Y z H U h t X . e x e
C : \ W H R q x g 6 5 . e x e
C : \ l E b t F 0 R 1 . e x e
C : \ J I V i x O e X . e x e
C : \ e 6 d 5 5 c a 7 4 6 6 a a 3 2 2 9 1 0 2 7 8 0 b b e 7 f 2 1 9 5 a 8 6 c a 6 1 d e 1 3 e 9 4 e f d 4 2 c a b c c 0 4 0 0 9 1 e 9
C : \ 7 8 9 e d c 6 5 c 3 5 0 f e 2 8 d e f a 5 8 2 3 5 9 8 f c f d b 8 4 c 9 6 d 2 a 1 7 c f 4 8 2 0 3 9 7 a 3 c 7 f 1 a a 5 f a a 1
C : \ B E 0 y x W Y c . e x e
C : \ 9 v _ d 0 8 O C . e x e
C : \ K 2 2 1 S k 8 E . e x e
C : \ f x S 0 6 R M h . e x e
C : \ 8 T G W x g O F . e x e
C : \ O X D Q W c Y a . e x e
C : \ p L 7 l R X Y z . e x e
C : \ D g l 4 C r t j . e x e
C : \ M 9 b Z 5 M Z H . e x e
C : \ I J K B U g G S . e x e
C : \ 5 R o D J U y Z . e x e
C : \ K B N 5 o t O X . e x e
C : \ j W H S 1 G v E . e x e
C : \ q X b B n x I 7 . e x e
C : \ 3 t h v 2 1 \ q v n 3 2 p . e x e
C : \ G G m O d y c Y . e x e
C : \ d 0 7 c 0 2 6 1 f 1 1 e f 0 0 8 1 6 a 1 1 b c f d b e e 5 7 b e a 4 6 e 0 1 0 1 d 0 e c a f 0 1 3 b a d 1 d 3 5 3 9 a 9 0 5 c 0
C : \ 3 6 3 b 0 3 7 7 6 7 7 2 c c 8 a d d 7 d d b 3 d 1 b f 6 c 9 b d 6 e 1 a 6 8 b 0 a 0 7 c 5 0 b f 1 f c 4 5 d a f 3 a 0 5 2 0 7 e
C : \ 8 0 5 6 e e c a 1 a e d d f 1 2 5 e 0 e 0 a 8 5 0 f e 9 5 2 9 2 8 e 7 7 8 8 6 4 7 5 2 9 9 2 f a a a b 2 e 7 2 a 6 f b c 9 c b 8
C : \ 4 4 b e b a 0 c d 2 3 b 7 7 2 5 5 7 b 1 f d 4 9 a 6 7 a 8 9 1 5 0 4 d 1 c 4 f 7 2 f 5 f 1 1 e 8 6 4 d 8 d f 2 0 1 d 6 d e 6 6 4
C : \ c 6 3 8 5 6 c 0 a 5 3 a f b c e 6 5 b 7 0 3 0 0 5 b 5 8 1 3 c 6 2 0 1 7 7 2 d d b 2 2 9 3 e a 6 6 a b a b a f 6 3 3 4 b f 8 3 c
C : \ 1 2 f d 7 c 6 2 a 1 7 f 8 a 7 c 7 0 3 d 5 8 3 b d d f f a 8 2 3 d 9 a 1 f c 3 0 c d f a 9 8 8 2 8 8 7 d 1 0 8 3 3 d d 8 8 9 a 5
C : \ U s e r s \ L i s a \ D e s k t o p \ Q u Q k F x s e . e x e
C : \ D Y t Y i R M 5 . e x e
C : \ d 9 5 1 0 0 8 f 1 9 9 8 d 8 3 f 7 c e e a 5 7 a 1 d 1 e 4 9 9 a f 2 6 6 7 a 9 f 6 1 9 0 b f 6 6 1 a 7 d f c 1 9 3 a d 2 e 6 b 3
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Z d L p Q D m Z . e x e
C : \ u F f T f Y p a . e x e
C : \ 0 2 9 7 3 5 c 9 a 1 2 0 2 c d 5 1 0 8 b 8 4 3 4 0 a 3 4 a e 3 3 4 1 2 4 e 9 1 e 7 5 e 4 c 1 e e c b c 4 1 1 3 f 7 e 6 f e 3 0 7
C : \ a 0 9 b f 1 3 c 1 7 6 6 a 7 f e e d 4 2 b f 9 2 a a 6 7 2 8 8 7 3 a e f 0 b 4 e 6 2 3 e 1 1 7 e 9 6 c a 3 8 9 7 b 0 5 7 9 6 b 7
C : \ 4 c c 2 f b 9 3 1 0 d f 3 c 6 8 d a 4 0 7 8 0 b 6 5 9 f 5 7 e a 7 a a f 9 6 7 7 f 3 5 9 1 f 1 1 7 4 3 3 2 9 b 5 1 5 0 e 3 9 f e
C : \ a 2 d e 7 1 e 9 5 3 7 2 d d 4 1 3 b 8 b 0 d 6 3 b 8 5 8 b 2 0 a 0 2 5 a 1 a 0 2 e 8 c c 3 0 b a 8 4 5 3 8 5 0 b 0 1 3 2 3 c b 9
C : \ b 2 e a d 0 4 a d d 5 f 3 2 1 3 8 1 4 0 a 1 a 0 9 1 7 1 f 9 9 c a 7 c 2 0 f c 5 5 4 5 9 b 8 b f b 7 5 9 8 f f 6 1 6 6 a 5 a 6 3
C : \ f d 5 b f 9 b 2 9 7 4 1 0 2 d d 5 6 0 b d 4 4 2 9 7 2 4 2 5 2 6 e a 9 7 5 e 0 a 7 9 e 6 1 a 4 a 0 f 2 f 3 d 4 9 6 c 5 b d d b 2
C : \ U s e r s \ L i s a \ D e s k t o p \ M y 9 6 p 1 w k . e x e
C : \ b c 1 c 1 7 e 9 e 8 a 4 0 f 8 1 3 7 1 6 7 7 d c a 2 a e 3 4 c b d e 6 f 0 1 0 9 8 7 7 4 f 6 9 d 2 a 5 0 6 c 1 0 5 2 0 e 6 7 5 9
C : \ U s e r s \ L i s a \ D e s k t o p \ Q q g v n 0 n T . e x e
C : \ 7 c 3 3 3 d 7 5 e a 5 7 0 4 d d e 3 9 a a 7 9 b e 2 4 9 4 8 2 1 a 7 4 6 3 5 f 6 1 c a 5 5 a 5 b 8 1 c 1 3 2 d a 3 1 d 6 8 9 3 d
C : \ U s e r s \ L i s a \ D e s k t o p \ v A S Z k f h P . e x e
C : \ d 4 5 1 f d 7 5 3 2 1 f 0 d 0 4 7 c d d a 5 2 1 a 6 f e 3 d c 8 4 3 9 c 8 5 c 3 4 f 1 e f f d a 3 4 7 2 2 6 0 b e 9 a c 7 e 5 d
C : \ U s e r s \ L i s a \ D e s k t o p \ l j i A a T i Y . e x e
C : \ a 9 a d e 0 3 0 a b 3 7 5 1 1 c 6 e 1 f 4 9 4 c 0 2 8 a 0 5 d 1 0 c f 9 1 6 0 3 8 f 9 7 9 3 0 9 2 e d d e c d 2 0 b 1 1 4 0 2 5
C : \ U s e r s \ L i s a \ D e s k t o p \ 2 L k n f p f z . e x e
C : \ 3 5 f f 7 0 9 3 e 1 1 f 5 c 1 4 e e 6 b c d e b 7 0 3 6 8 d a 8 5 8 2 3 9 a 4 2 0 7 c c 6 3 e 8 6 5 2 8 a 2 c 9 c a b 3 2 1 7 0
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ Y U u f Y 5 P M . e x e
C : \ 2 4 7 0 d 2 3 2 2 5 5 5 a 4 e 0 5 7 d e 7 8 2 4 0 3 7 a b 0 7 7 2 1 9 6 5 d 1 8 1 6 b 0 0 6 0 a 5 a d 6 b f b 0 9 f f a 1 7 b 3
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ B S L O P W M T . e x e
C : \ f R o C S 1 U G . e x e
C : \ D o c u m e n t s a n d S e t t i n g s \ l u s e r \ D e s k t o p \ l q Q 2 Q S E o . e x e
C : \ 5 c 0 0 5 3 1 e a c 8 f b 4 0 1 6 3 0 2 9 8 4 c 5 b 2 0 f 9 e 5 8 e 0 e 4 d a 5 0 9 4 2 d 8 a b c b e d b 5 6 3 c 8 3 c 9 9 f 8
C : \ 7 f f 4 2 5 b 9 f 4 b c d 2 9 7 a a a 3 7 1 d 5 a 9 c f c 8 9 b e 7 6 1 9 8 9 b 1 8 9 b 6 8 4 8 0 2 2 9 6 4 a 7 8 3 f 1 3 5 2 a
C : \ j t n I k f 6 A . e x e
C : \ 5 9 1 4 3 a 2 0 a 6 1 2 6 9 9 6 d 0 3 3 0 8 c c 7 b 1 f 8 a c f f a 8 f 6 6 6 7 7 7 5 b 0 9 2 b 2 b 7 2 0 2 8 a 0 3 4 6 e 4 2 8
R E S O U R C E _ F A T O K E N I Z E R
K E R N E L 3 2 . D L L
s m s c o r e e . d l l
n r u n t i m e e r r o r
T L O S S e r r o r
S I N G e r r o r
D O M A I N e r r o r
- A t t e m p t t o u s e M S I L c o d e f r o m t h i s a s s e m b l y d u r i n g n a t i v e c o d e i n i t i a l i z a t i o n
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n . I t i s m o s t l i k e l y t h e r e s u l t o f c a l l i n g a n M S I L - c o m p i l e d ( / c l r ) f u n c t i o n f r o m a n a t i v e c o n s t r u c t o r o r f r o m D l l M a i n .
- n o t e n o u g h s p a c e f o r l o c a l e i n f o r m a t i o n
- A t t e m p t t o i n i t i a l i z e t h e C R T m o r e t h a n o n c e .
T h i s i n d i c a t e s a b u g i n y o u r a p p l i c a t i o n .
- C R T n o t i n i t i a l i z e d
- u n a b l e t o i n i t i a l i z e h e a p
- n o t e n o u g h s p a c e f o r l o w i o i n i t i a l i z a t i o n
- n o t e n o u g h s p a c e f o r s t d i o i n i t i a l i z a t i o n
- p u r e v i r t u a l f u n c t i o n c a l l
- n o t e n o u g h s p a c e f o r _ o n e x i t / a t e x i t t a b l e
- u n a b l e t o o p e n c o n s o l e d e v i c e
- u n e x p e c t e d h e a p e r r o r
- u n e x p e c t e d m u l t i t h r e a d l o c k e r r o r
- n o t e n o u g h s p a c e f o r t h r e a d d a t a
- a b o r t ( ) h a s b e e n c a l l e d
- n o t e n o u g h s p a c e f o r e n v i r o n m e n t
- n o t e n o u g h s p a c e f o r a r g u m e n t s
- f l o a t i n g p o i n t s u p p o r t n o t l o a d e d
M i c r o s o f t V i s u a l C + + R u n t i m e L i b r a r y
< p r o g r a m n a m e u n k n o w n >
R u n t i m e E r r o r !
P r o g r a m :
H H : m m : s s
d d d d , M M M M d d , y y y y
M M / d d / y y
D e c e m b e r
N o v e m b e r
O c t o b e r
S e p t e m b e r
A u g u s t
F e b r u a r y
J a n u a r y
S a t u r d a y
F r i d a y
T h u r s d a y
W e d n e s d a y
T u e s d a y
M o n d a y
S u n d a y
W U S E R 3 2 . D L L
( ( ( ( ( H
C O N O U T $
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 7 8 d 6 8 1 e 8 e e e 2 e c 6 e 0 9 b c f 3 6 f f 9 e c a a 0 1 3 5 d d c 3 a 0 e 8 3 4 0 c d b 8 3 a 8 1 2 6 b b 8 1 e f c 4 c . e x e
c : \ t a s k \ 5 D A 1 4 B B 7 D 2 6 7 C A E 1 E F 3 4 0 8 1 B 8 5 0 0 F F E 4 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a 8 b 9 d 9 f c 1 e a e e 8 4 1 0 3 7 5 2 3 5 f b 6 9 a f 8 2 e . v i r u s . e x e
C : \ 8 b 7 3 7 2 1 9 7 f e 9 9 f 6 8 f 8 2 9 b 7 5 3 d 1 e b f 9 1 e 8 7 f 3 8 c 3 8 2 2 b 4 6 2 5 0 1 1 6 c b 2 d 2 d c 1 1 5 b 7 7
C : \ D o c u m e n t s a n d S e t t i n g s \ A d m i n i s t r a t o r \ D e s k t o p \ u Z 6 O c d F 9 . e x e
C : \ 8 a b 1 d 9 8 b e a 1 6 f 1 d 8 f 1 7 3 a 6 b 8 e 0 f 8 a b f 1 1 7 b d d 8 a 0 7 b a a 8 7 c b 4 f 0 e 0 3 c 7 c c b 9 6 1 d 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w s a c e . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w s a c e . p e 3 2
C : \ 2 d 6 a 0 d c 0 c 4 5 b 6 c d f 6 9 c a 1 5 c f 9 0 5 c 9 f a a c 0 2 2 9 6 3 1 4 7 4 c 3 e 2 9 c 4 9 c 3 1 6 6 2 1 7 d c b 4 0
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w s a c e . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w s a c e . p e 3 2
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 4 c 9 9 e e 3 d d 4 9 b c e 8 3 _ w s a c e . e x e
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w s a c e . p e 3 2
C : \ 4 1 b 6 0 5 f f 5 f 0 6 8 4 3 8 e 5 c d 7 4 1 7 8 0 1 4 d 5 a 8 a 0 1 f 4 b d 4 9 5 8 f 5 8 5 7 f 9 e 8 1 5 1 c 9 2 f 1 0 b a 0
C : \ a 8 c a 2 3 d a e 1 4 e a f 6 e 6 4 f 7 a b f b b e 3 1 8 8 7 7 c 4 2 7 0 7 0 7 b c a f 5 c 5 d 4 b 1 a c f a f d 6 3 8 d 0 8 f
C : \ 9 8 6 0 4 6 9 f 8 3 f 8 b 6 7 4 d 7 c b 9 b b 3 3 9 a d e 5 b 2 1 3 2 2 8 3 c 5 4 b 6 c 6 4 6 b 5 b a e 5 e c 0 a 5 8 9 5 6 e f
C : \ 5 8 b 3 9 2 3 8 9 5 4 2 1 8 6 5 8 f f 7 7 e 4 7 b d f c a a 9 a d 7 a 1 3 6 1 7 7 0 a d e f e 2 e 9 a 1 0 2 3 9 c 7 6 3 b e 0 f
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ a c d 8 b 9 e 9 f d 2 b 3 5 0 e 3 3 d 7 b c e 0 0 4 9 6 c 3 0 a 5 9 8 9 4 0 b c d 4 1 3 3 1 3 a 4 a 8 b 2 e 4 7 4 2 4 e 7 1 3 7 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c c 1 7 f a 6 2 1 7 8 2 4 f 2 9 0 a b f b 4 8 5 7 0 1 0 e e c 5 d e 2 3 2 a 2 a 3 4 4 0 8 a f b 7 6 5 b 3 d 8 e d c f 0 7 6 7 1 . e x e
C : \ 4 2 5 f 0 6 1 b 0 c 4 8 6 3 1 5 d d a 0 9 c 5 b 2 f 2 f 5 a 2 9 b 0 8 5 d f 6 8 6 c f 0 d 9 3 0 1 d 0 b d a 9 5 7 8 0 b 5 8 d d
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ 2 a 1 1 9 2 3 e 4 c 0 d a d a d 8 b e 3 a 1 6 7 d 4 1 f 7 9 9 8 0 b 1 b 3 a 3 c 6 f a f 4 6 0 6 9 f 2 7 5 3 0 0 c 8 6 d 4 d b 1 . e x e
C : \ 5 6 1 b 4 2 9 9 0 f 0 6 6 a d f d 3 f a 5 e f 4 d e d b e d e 3 4 4 8 4 3 8 d 1 2 5 6 1 0 6 5 9 3 7 0 c c 9 6 b 4 2 1 9 6 f d 3
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ c 2 8 4 4 1 6 4 9 6 8 8 b 5 7 3 7 d d b e f 5 a 7 2 4 b 4 e 9 8 5 a 5 b f 2 1 d f 2 3 1 3 8 c 8 d 4 9 3 2 9 1 1 1 9 f 0 a 1 9 9
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ w s a c e . e x e
C : \ 1 2 1 f 9 5 4 e 9 d b 7 3 2 2 f 8 d 2 b a 7 8 1 a d 1 6 b 8 d 6 a e 8 9 f 6 f b a 8 d 1 d d 2 4 3 b a b 9 3 2 b 2 e 1 9 0 6 a 2
C : \ c e 1 b 3 5 7 4 b 2 b 7 4 f 1 0 9 e d 5 d e b e f c e 9 4 5 8 1 7 7 0 8 2 5 9 b 3 c a 0 4 f 1 d a 5 1 4 9 6 4 2 9 d c 6 f b 3 a
C : \ 7 0 0 d f 4 e 9 0 8 d 8 7 c 1 b b d 5 8 b 3 1 d 7 1 5 c 0 8 c 0 c d 5 0 9 5 6 2 8 5 9 0 8 9 c 7 0 4 a e 1 f c 0 4 3 5 6 e 3 4 c
C : \ 0 e e 0 c d 5 2 d 6 d 1 4 5 9 e f a 3 e 9 3 6 3 6 f 2 c f d 5 a c d 5 e c 9 9 a 4 c 9 2 f c 1 d 5 4 d b 0 0 2 2 5 1 7 8 3 f c c
C : \ c f 8 c b 5 5 e d 0 f 3 b 6 b 9 8 8 c a f 5 8 e 0 8 9 6 4 f 5 b e 2 3 9 3 4 8 8 b b d f 4 7 f 1 4 6 4 9 7 4 2 b 4 a 1 a 5 2 b 7
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w s a c e . p e 3 2
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ w s a c e . p e 3 2
Process Tree
-
0151c0440dc1a16f5e722fee702e57eb301580b9e3be75180489e8f304eb4d5a.exe (1064)
"C:\Users\Administrator\AppData\Local\Temp\0151c0440dc1a16f5e722fee702e57eb301580b9e3be75180489e8f304eb4d5a.exe"
- wsace.exe (2736) "C:\Users\ADMINI~1\AppData\Local\Temp\wsace.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 1fcd5df1fd64f291_wsace.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\wsace.exe |
| Size | 56.2KB |
| Processes | 1064 (0151c0440dc1a16f5e722fee702e57eb301580b9e3be75180489e8f304eb4d5a.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | 78d008bcc8d75ced6c538788e77169c7 |
| SHA1 | 8d68d6fc57733b6199b22badd3248cb4d769729a |
| SHA256 | 1fcd5df1fd64f29120200b136371828a0451566bd12fa32f5cb02a6ef3725d71 |
| CRC32 | D41A7FA9 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.