1.0
低危
DACN
0.12
FACILE
1.00
IMCLNet
0.69
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | TrojanDownloader:Win32/Upatre.f5c61c5b | 20190527 | 0.3.0.5 |
| Avast | Win32:Kryptik-OZW [Trj] | 20200514 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.b | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (W) | 20190702 | 1.0 |
| Kingsoft | None | 20200514 | 2013.8.14.323 |
| McAfee | Downloader-FSH!F3DD6C214B76 | 20200514 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b079ea | 20200514 | 1.0.0.1 |
静态指标
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(3 个事件)
| section | DATA |
| section | rsrc |
| section | uinC |
动态指标
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意
(50 out of 63 个事件)
| ALYac | Trojan.GenericKD.1838094 |
| APEX | Malicious |
| AVG | Win32:Kryptik-OZW [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.1838094 |
| AhnLab-V3 | Trojan/Win32.Zbot.R118957 |
| Alibaba | TrojanDownloader:Win32/Upatre.f5c61c5b |
| Antiy-AVL | Trojan/Win32.Fsysna |
| Arcabit | Trojan.Generic.D1C0C0E |
| Avast | Win32:Kryptik-OZW [Trj] |
| Avira | TR/Yarwi.A.475 |
| Baidu | Win32.Trojan-Downloader.Waski.b |
| BitDefender | Trojan.GenericKD.1838094 |
| BitDefenderTheta | Gen:NN.ZexaF.34108.fqZ@aGEvYRc |
| CMC | Trojan.Win32.Cutwail!O |
| ClamAV | Win.Trojan.Upatre-6140 |
| Comodo | TrojWare.Win32.Crypt.C@7vajd0 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Cybereason | malicious.14b76a |
| Cylance | Unsafe |
| Cyren | W32/Trojan.RZDO-5377 |
| DrWeb | Trojan.DownLoad3.33795 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.F |
| Emsisoft | Trojan.GenericKD.1838094 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.KNO |
| FireEye | Generic.mg.f3dd6c214b76ac7a |
| Fortinet | W32/Upatre.FT!tr |
| GData | Trojan.GenericKD.1838094 |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | TrojanDownloader.Upatre.aw |
| K7AntiVirus | Trojan ( 0001140e1 ) |
| K7GW | Trojan-Downloader ( 0049d22b1 ) |
| Kaspersky | Trojan-Downloader.Win32.Upatre.dfv |
| Lionic | Trojan.Win32.Cutwail.tn30 |
| MAX | malware (ai score=86) |
| Malwarebytes | Trojan.Upatre |
| McAfee | Downloader-FSH!F3DD6C214B76 |
| McAfee-GW-Edition | BehavesLike.Win32.Downloader.mt |
| MicroWorld-eScan | Trojan.GenericKD.1838094 |
| Microsoft | TrojanDownloader:Win32/Upatre |
| NANO-Antivirus | Trojan.Win32.Cutwail.denqqa |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | Win32/Trojan.Downloader.Upatre.A |
| Rising | Trojan.Waski!1.A489 (CLOUD) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Cutwail |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Agent-AIRG |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-04-23 15:37:18
PE Imphash
ec37f725b2689e4932373eab7c062bfb
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00007200 | 0x00001400 | 1.734577852755738 |
| DATA | 0x00009000 | 0x00004200 | 0x00001c00 | 4.560203405470213 |
| rsrc | 0x0000e000 | 0x00006000 | 0x00005c00 | 4.078976975346756 |
| uinC | 0x00014000 | 0x000001f0 | 0x00000200 | 0.0 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_MENU | 0x0000e1d2 | 0x00000137 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_MENU | 0x0000e1d2 | 0x00000137 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_BITMAP | 0x0000e309 | 0x00003244 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_ICON | 0x0001154d | 0x000025a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00013af5 | 0x00000014 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library dbghelp.dll:
• 0x409000 DbgHelpCreateUserDump
Library GLU32.dll:
• 0x409008 gluBeginCurve
• 0x40900c gluBeginPolygon
• 0x409010 gluBeginSurface
• 0x409014 gluBeginTrim
• 0x409018 gluBuild1DMipmaps
• 0x40901c gluBuild2DMipmaps
• 0x409020 gluCylinder
• 0x409024 gluDeleteNurbsRenderer
• 0x409028 gluDeleteQuadric
• 0x40902c gluDeleteTess
• 0x409030 gluDisk
• 0x409034 gluEndCurve
• 0x409038 gluEndPolygon
• 0x40903c gluEndSurface
• 0x409040 gluEndTrim
• 0x409044 gluErrorString
• 0x409048 gluErrorUnicodeStringEXT
• 0x40904c gluGetNurbsProperty
• 0x409050 gluGetString
• 0x409054 gluGetTessProperty
• 0x409058 gluLoadSamplingMatrices
• 0x40905c gluLookAt
• 0x409060 gluNewNurbsRenderer
• 0x409064 gluNewQuadric
• 0x409068 gluNewTess
• 0x40906c gluNextContour
• 0x409070 gluNurbsCallback
• 0x409074 gluNurbsCurve
• 0x409078 gluNurbsProperty
• 0x40907c gluNurbsSurface
• 0x409080 gluOrtho2D
Library kernel32.dll:
• 0x409088 MapViewOfFileEx
• 0x40908c GetACP
• 0x409090 GetSystemDirectoryA
• 0x409094 LocalFree
• 0x409098 SetConsoleTitleW
• 0x40909c EnumCalendarInfoW
• 0x4090a0 GetFileSize
• 0x4090a4 ReadFile
• 0x4090a8 CreateFileA
Library adsldpc.dll:
• 0x4090c0 ADSIFreeColumn
• 0x4090c4 ADSIGetColumn
• 0x4090c8 ADSIGetFirstRow
• 0x4090cc ADSIGetNextColumnName
• 0x4090d0 ADSIGetNextRow
• 0x4090d4 ADSIGetObjectAttributes
• 0x4090d8 ADSIGetPreviousRow
• 0x4090dc ADSIModifyRdn
Library msrating.dll:
• 0x4090e4 RatingCustomInit
Library MTXCLU.DLL:
• 0x4090ec MtxCluIsClusterPresent
Library SAMLIB.dll:
• 0x4090f4 SamAddMemberToAlias
L!This program cannot be run in DOS mode.
vsRich
Rhr.dlhduse\
uX[YZa`
YD94D9
DbgHelpCreateUserDump
dbghelp.dll
gluBeginCurve
gluBeginPolygon
gluBeginSurface
gluBeginTrim
gluBuild1DMipmaps
gluBuild2DMipmaps
gluCylinder
gluDeleteNurbsRenderer
gluDeleteQuadric
gluDeleteTess
gluDisk
gluEndCurve
gluEndPolygon
gluEndSurface
gluEndTrim
gluErrorString
gluErrorUnicodeStringEXT
gluGetNurbsProperty
gluGetString
gluGetTessProperty
gluLoadSamplingMatrices
gluLookAt
gluNewNurbsRenderer
gluNewQuadric
gluNewTess
gluNextContour
gluNurbsCallback
gluNurbsCurve
gluNurbsProperty
gluNurbsSurface
gluOrtho2D
GLU32.dll
MapViewOfFileEx
GetACP
GetSystemDirectoryA
LocalFree
SetConsoleTitleW
EnumCalendarInfoW
GetFileSize
ReadFile
CreateFileA
kernel32.dll
ADSIGetColumn
ADSIFreeColumn
ADSIModifyRdn
adsldpc.dll
ADSIFreeColumn
ADSIGetColumn
ADSIGetFirstRow
ADSIGetNextColumnName
ADSIGetNextRow
ADSIGetObjectAttributes
ADSIGetPreviousRow
ADSIModifyRdn
adsldpc.dll
RatingCustomInit
msrating.dll
MtxCluIsClusterPresent
MTXCLU.DLL
SamAddMemberToAlias
SAMLIB.dll
=h$F2w7
d.gzi
5`2?QB
fHee@62W7
V~V:%\
0 Dq-${&*g
FFF2EFF02FFFFju&x*:
OFFt^FFFjf@f@jJ|DFzJ~Hr13&
rk)02EFF
BV02EFF
r9s{02EFF
r202FF(rL:B02FF.r[6b02FF$rb02FF&r~[02FF
T0fX02fn4sfrFNFF4sF
62FFFFj&r
EFF*n2zEFF*2bnsf40
sfrFNFFrDFFsF
*rDFF0(sFr
FFFssFsrFFF
sfrFNFFrd_FFsF
,sfrFNFFsfsF
sfrFNFFsfsF
sfrFNFFsfsF
sFsFrFF
$sF2bnsf
&sF2bnrd_FF,
2#GFFsFsf
2GFFnsf
,D,nrd_FF,
,fX,"fEu "l2bnsf0
0,2<FF"
f@0n62GFF
&@F"|z0sFsFn
20FFFn
F"|&G0FFF
fN04J4&D4
p"&FFF|Q0@
FFFdTD
FFsF|T&sFn
T~OFFdTDj
J|EF0&NnomhTV
FF/>FF*FF*%LFF*FFF
FFFlTH
ikj'BFom=
[9ueu9Fik'DFomu
FF`TT/&
$_4xTH:
F_4xTJ:
F_4xTJ:
ik'NFom=&`TTxTJ:G
9&T_4e|TVik'NFnol2bnsf|TT|TT
|TT|TH|TR2
FFFhkj'LFo
t^FFF@@
JkhTB&&_
F'DFomhTLXhTLzhTLVhTL=lTLo2DedTJ&2aThTL\HlTLD dTLik'BFno`THlTJhTL|C
7=kj'@Fv?}Xm\/
n$nonsDrFNFF2DnsDrFNFFDTFNFF
k""D&uuF^|B
FFL71dTDon^rFNFF2Dn^rFNFFDTFNFF
kjj`T@hTD
g70'@F
!"#$%&'()*+,-./0123456789:;<=>?@Ah
B)a10pm> GYuy9\oys
1+Lmx4W
Wtwo.e"hsI F^
& 6'/Q{m65aHXm
<6+^tN1
PHKx93
152C!X'#
!gIe^tYd(>
O}Q[r$
E-d<)B0A->I3K6F1t\B
C<rOh]
]D<O;7\y{
f*!W|Vn
pB+NZrM9~
hM03kt
13\x54
.\H uxVkG{\Bi3
MT8s|#( Cy
:5D^[M8
&{C7}9=Nfz
rzB#vK
p+v*M``.
Vza?~q{<
5HBK@{<
'\.fEN^
6e7&(=
2Y0{v6HR
YtxmNi
&NvV~1"
m;22=j'od+cco
z2kxlc#x
wWeR-3@i
^dK Q|f9
FPOMqK:uZT
kbA3Zl
)aq7\4jpgt
j /1A^h
$i*:PG];+-
4EC**P
zl?WP!#
S&?B] kWYd
T^GME}_E
Lec zk
3fR@j?ylE
sX`wfA
g@:_Z?.q% Di
%o=/eyI)aRXc
{Xv iY
~ItQJUE
"{*;R,"
T.;zi}
8Z]&j@(f#9f
Dal|.%v
lrOPYf$y(
RY99cGqeHRW%=
14UH]FYlP
g]q\}a9xM
c\9\&&r=8+
/YRZ7`-z--D~
uL1Exyr
w#|ysdX
uu*.?4d
Ih4_wFjaV
Cc0wR%
$F)<:!=-bJ
*c9?S<|%T
6x$#XBu
|p/a!cwN?zJXtx
</,#S[D
sCI+u:R3K
V~bm||2pV.3
zuMEsZ
~Ya*%;<MGXd81MQ
eCf'nY B:h
P~Boxav`
}n8F~b }
vrt|v&B
ky=DripsJ
&xlv(gQ
n\kW'^
|H3Xa<5Y5
':]j %}^
Wk@N?["w
|l{{2#AzF<dM
AP^0#;hE$ja
D:K;Q^O7E)
6t0iX7f
+HD}H3$
*ur$$$
1]u$$$
0Tf$$$
!Nv$$$
BfhBf$$$
+!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5!5
1!3!3!3!3!3!3!3!3 4!3!3!3!3 4 4 4!5!3!3 4!3!3!3!3!3!3!3!3!3!3
3"7"7"7"7"7"7"7"7"7"7"7"7ny"7"7"7"7"7"7"7"7"7"7"7"7 3$$$
3#9#9#9#9#9#9#9#9"7"7#5#9s{#9#9#9#9#9#9#9#9#9#9#9#9 3$$$
3*>*>*>*>*>*>*>*>*>*>t}*>*>#5#5'<*>*>*>*>*>*>*>!3$$$
#8/@/@/@/@/@/@/@/@LW/@/@.B/@/@/@/@/@/@/@/@/@#8$$$
*>5I5I5I5I5I5I5I5I5Ift5I5Ix
5I5I5I5I5I5I5I5I5I5I5I5I*>$$$
1E:M:M:M:M:M:M:M:Mgw:Mgw:M:M1E1E:M:M:M:M:M:M:M:M1E$$$
:M?O?O?O?O?O?O?O?O?O~?O?O?O?O?O?O?O?O?O:M$$$
?OFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFUFU?O$$$
HZJYFUFUFUJYJYJYJYJYJYJYJYJYJYJYJYJYJYJYJYJYFUFUFUFUFUFUJYJYJYHZ$$$
HZHZovovovovovovovovovovovovovovovovovovovovovovovovovovovovHZO`$$$
L!This program cannot be run in DOS mode.
`.reloc
B.rsrc
8g&%\r
S^ =Z(U
S^ +Z(U
8gjX_r
S^ /Z(U
S^ 'Z(U
S^ /Z(U
S^ 'Z(U
S^ !Z(U
S^ ?Z(U
S^ /Z(U
S^ 'Z(U
S^ /Z(U
S^ 'Z(U
S^ 'Z(U
S^ +Z(U
* Y73P
S^ #Z(U
fZ`Z[[
i\Z\X8
S^ +Z(U
S^ +Z(U
S^ /Z(U
S^ /Z(U
_&`iXX
S^ ?Z(U
8`&Z[\
8&&`[\%r
8hXjZfffghhrG
KZ&F
S^ %Z(U
S^ 'Z(U
8ZZ%&h
8hhg\jfgi
S^ aZ(U
88Z`hgf*
fZ&Z[8
88XZ&%_h
8[&\%`8%`_gjrG
`LR [
A r2(M
A r2(M
A r2(M
A r2(M
A r2(M
A r2(M
A r2(M
A r2(M
8&f`r-
&hih__
8hgY*A4
p[`%`8^*
8fi_Z~
8`h\j%8
h`\g`f
jj`j[X*
8_j`8*
8iZj%Y
8fXZX_g%
&Y_i[8
`Y8@&j
88iYrU
8[\Z\Zhj*
hgj&\r
j\&%g8
X%\j_&
\_[Y%g8iY
pij`iXh`
8%[`&*
p`8ej\`\r
8gf[j`Y8YZi*
pXZ[Zj
8&[Zj*
88`Y_*
8Yhj[*
s !C y
ML' gC y
pXXij%i
__iYY\8
p8gg[r
8%h[_ri
&_YYXiff[8~
`i\ Z.^[ 0
8 ! ~O x
iXZg%Yi
K B-(C
K B-(C
8YX[f8
i&X\r-
X_jggf
h&ZhX%[&%
'{Zt
K B-(C
K l-(C
K l-(C
8YiY&Y
8[8_[*
jjZh8Z\
[[[XZj
8\ffY\
pZf\Y`
&[f\jg
pj&%_rK
4, .(%
p\gi_`g
Zf`f\%
p`&jr#
8X`g&g`%
88[&%\
8%f&ZYYh
X&hgXg
8g%gfi
8P $L}] R4,
pXji&8
8_&[%\\8
hiXf&8j_h
#g uZ
a2"^ Z
f%fhf\Y8h
8f` p| Z
fj%\[%8
i&Y\[%
8_`[\Xf&
p[\&hj8
8j[`%\
8jf_j*
_b`}
Yj_i*8
8e\_\g
g[f8fjX
8Zii_rG
_ _d}
8_[`g`h
(h'D
V; {!. w
8Xjg\XYX`
Xi`&__[8`
8\_f8*
8[`Xjf
88Xgi*
Xgj\%g
YgXf8!
8Z%`g&*
pg_ZY%g
8fjh[hfri
(k[ S >=^(A
_I S P=^(A
g`Z_&frG
8&j%&_`*
%f`_%f
pf_j8h
8\\Xgr
8gh&&Z*
h`ihX[
8&%jhj
jf[f\X
8Yg8`X_*
8&j_Zgg&\r
8%X_Yh8
`jgji%gZ
[i[%Y`fY
8$`%iY*
\Yh[[8
8YYYYY
8_`g%Y*
Y _bX
Y _bX"
[g&h%g
8X__ZYiXg
C : \ U s e r s \ a d m i n i s t r a t o r \ A p p D a t a \ L o c a l \ T e m p \ w z d 2 a a \ S t a t e m e n t . s c r
C : \ j s b v 6 Y Z z . e x e
C : \ J S 8 H f o 2 Z . e x e
C : \ d b U Q k 0 j C . e x e
C : \ B t d I G f s 0 . e x e
C : \ V i E S f _ o 3 . e x e
C : \ q K f m f O C 1 . e x e
C : \ t t s _ i Q 2 t . e x e
C : \ Y s C 0 F f o 1 . e x e
C : \ Z u Z S K O 4 m . e x e
C : \ 8 o 8 W w h C w . e x e
C : \ A o h Z b Z b Q . e x e
C : \ 6 E w T n F v H . e x e
C : \ i V z 1 k c W A . e x e
C : \ 6 E e C P 6 Y 3 . e x e
C : \ r i p Q C o n G . e x e
C : \ M s E p T Z 3 5 . e x e
C : \ e F p V Z Y Z a . e x e
C : \ i a X U o 8 W _ . e x e
C : \ F O U 3 X f z t . e x e
C : \ P l 8 V W J 9 T . e x e
C : \ t k r v x z y a . e x e
C : \ 9 e z 3 d X _ _ . e x e
C : \ 9 4 e K r b a f . e x e
C : \ x E L e Q E 6 n . e x e
C : \ E E C p n 6 U 8 . e x e
C : \ U Z I U Y Y X r . e x e
C : \ Q E 8 a 7 n N 3 . e x e
C : \ 3 n B R D K l X . e x e
C : \ a U f 1 y F b b . e x e
C : \ q P b q S w M 9 . e x e
C : \ w 0 R 4 w b v I . e x e
C : \ K x I i 5 K X D . e x e
C : \ p r X z X 3 _ E . e x e
C : \ E p G u 6 F r g . e x e
C : \ b W y D M z H 4 . e x e
C : \ 9 u 2 C Q 0 G l . e x e
C : \ x B 6 G 5 f r A . e x e
C : \ G N k q u D N d . e x e
C : \ e 4 c 8 e f 8 2 c 1 b c 6 0 9 9 f 9 c 7 b 2 f 0 d f 1 2 c 0 3 d d 6 c e 5 f 0 a 4 3 4 8 e 6 f 1 7 d 7 5 a f d 7 8 c 5 3 e 4 8 3
C : \ U s e r s \ P e t r a \ A p p D a t a \ L o c a l \ T e m p \ m p j n r . p e 3 2
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com |
A 131.107.255.255
A 131.107.255.255 |
131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58485 | 8.8.8.8 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
No ICMP traffic performed.
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
Sorry! No dropped files.
Sorry! No dropped buffers.