2.2
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.66
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Kryptik-MBV [Trj] | 20200217 | 18.4.3895.0 |
| Baidu | None | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200217 | 2013.8.14.323 |
| McAfee | Dropper-FGJ!F6D66466AA05 | 20200217 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b6438f | 20200217 | 1.0.0.1 |
静态指标
查询计算机名称
(1 个事件)
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1727545302.843625 GetComputerNameW |
computer_name:
TU-PC
|
success | 1 | 0 |
检查进程是否被调试器调试
(1 个事件)
收集信息以指纹识别系统 (MachineGuid, DigitalProductId, SystemBiosDate)
(1 个事件)
| registry | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid |
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报）
(2 个事件)
| section | AUTO |
| section | DGROUP |
一个或多个进程崩溃
(16 个事件)
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\ProgramData\Mozilla\iqbjnwa.exe |
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
生成一些 ICMP 流量
文件已被 VirusTotal 上 58 个反病毒引擎识别为恶意
(50 out of 58 个事件)
| ALYac | Trojan.GenericKD.41985898 |
| APEX | Malicious |
| AVG | Win32:Kryptik-MBV [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.GenericKD.41985898 |
| AhnLab-V3 | Win-Trojan/Dofoil.Gen |
| Antiy-AVL | Trojan/Win32.ShipUp |
| Arcabit | Trojan.Generic.D280A76A |
| Avast | Win32:Kryptik-MBV [Trj] |
| Avira | TR/Crypt.ZPACK.Gen7 |
| BitDefender | Trojan.GenericKD.41985898 |
| BitDefenderTheta | Gen:NN.ZexaF.34090.iuX@aq2knyn |
| Bkav | HW32.Packed. |
| CAT-QuickHeal | TrojanDropper.Gepys.A |
| ClamAV | Win.Trojan.Gepys-32 |
| Comodo | TrojWare.Win32.Kryptik.BEDR@507qmy |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.6aa051 |
| Cylance | Unsafe |
| Cyren | W32/Gepys.AE.gen!Eldorado |
| DrWeb | Trojan.Mods.1 |
| ESET-NOD32 | a variant of Win32/Kryptik.BDJQ |
| Emsisoft | Trojan.GenericKD.41985898 (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Gepys.AE.gen!Eldorado |
| F-Secure | Trojan.TR/Crypt.ZPACK.Gen7 |
| FireEye | Generic.mg.f6d66466aa051ab3 |
| Fortinet | W32/Kryptik.BCX!tr |
| GData | Trojan.GenericKD.41985898 |
| Ikarus | Trojan-Dropper.Win32.Gepys |
| Invincea | heuristic |
| Jiangmin | Trojan/Generic.axfdn |
| K7AntiVirus | Trojan ( 0040f4c81 ) |
| K7GW | Trojan ( 0040f4c81 ) |
| Kaspersky | HEUR:Trojan.Win32.Generic |
| Malwarebytes | Trojan.Agent.RRE |
| MaxSecure | Trojan.Malware.300983.susgen |
| McAfee | Dropper-FGJ!F6D66466AA05 |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.ch |
| MicroWorld-eScan | Trojan.GenericKD.41985898 |
| Microsoft | Trojan:Win32/Yakes.DSK!MTB |
| NANO-Antivirus | Trojan.Win32.ShipUp.bxpjhz |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM20.1.4D57.Malware.Gen |
| Rising | Dropper.Gepys!8.15D (TFE:2:zSFZZ7SGMZQ) |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
| Sophos | Troj/Gepys-A |
| Tencent | Malware.Win32.Gencirc.10b6438f |
| Trapmine | malicious.high.ml.score |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2011-06-23 01:43:07
PE Imphash
524680b995bebe66b0934014c8549a64
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| AUTO | 0x00001000 | 0x00001f7f | 0x00002000 | 6.428597887004499 |
| DGROUP | 0x00003000 | 0x00058304 | 0x0001d600 | 6.596481821683854 |
| .idata | 0x0005c000 | 0x00000728 | 0x00000800 | 4.747698563972165 |
| .reloc | 0x0005d000 | 0x00000000 | 0x00000400 | 5.02709319820263 |
| .rsrc | 0x0005e000 | 0x00000000 | 0x00000e00 | 3.6639222417639887 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_DIALOG | 0x0005d2c0 | 0x0000040c | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_DIALOG | 0x0005d2c0 | 0x0000040c | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
Imports
Library CRYPT32.DLL:
• 0x45c1a4 CryptStringToBinaryA
Library USER32.DLL:
• 0x45c1b8 FindWindowW
• 0x45c1bc GetDC
• 0x45c1c0 GetParent
• 0x45c1c4 LoadCursorW
• 0x45c1c8 LoadIconW
• 0x45c1cc MapDialogRect
• 0x45c1d0 RegisterClassW
• 0x45c1d4 ReleaseDC
• 0x45c1d8 wsprintfW
• 0x45c1dc KillTimer
Library KERNEL32.DLL:
• 0x45c1e4 CloseHandle
• 0x45c1e8 CreateFileW
• 0x45c1ec CreateMutexA
• 0x45c1f0 CreateMutexW
• 0x45c1f4 DeleteFileW
• 0x45c1f8 FindClose
• 0x45c1fc FindFirstFileA
• 0x45c200 FindFirstFileW
• 0x45c204 FindNextFileA
• 0x45c208 FindNextFileW
• 0x45c20c GetComputerNameW
• 0x45c210 GetCurrentProcess
• 0x45c214 GetCurrentProcessId
• 0x45c218 GetCurrentThreadId
• 0x45c21c GetFileTime
• 0x45c220 GetLastError
• 0x45c224 GetModuleFileNameW
• 0x45c228 GetModuleHandleA
• 0x45c22c GetModuleHandleW
• 0x45c230 GetProcAddress
• 0x45c234 GetStartupInfoW
• 0x45c238 GetSystemDirectoryW
• 0x45c23c GetSystemTimeAsFileTime
• 0x45c240 GetTickCount
• 0x45c244 LoadLibraryA
• 0x45c248 OpenProcess
• 0x45c24c QueryPerformanceCounter
• 0x45c250 SetUnhandledExceptionFilter
• 0x45c254 TerminateProcess
• 0x45c258 UnhandledExceptionFilter
• 0x45c25c VirtualProtect
• 0x45c260 WriteFile
• 0x45c264 lstrlenW
• 0x45c268 GetVersionExW
Library RPCRT4.dll:
• 0x45c270 UuidToStringW
Library ADVAPI32.dll:
• 0x45c278 RegCreateKeyExW
• 0x45c27c RegOpenKeyExW
• 0x45c280 RegQueryValueExW
• 0x45c284 RegSetValueExW
• 0x45c288 RegCloseKey
Library GDI32.dll:
• 0x45c290 BitBlt
• 0x45c294 CreateCompatibleBitmap
• 0x45c298 DeleteObject
• 0x45c29c SelectObject
• 0x45c2a0 CreateCompatibleDC
L!This is a Windows 95 executable
`DGROUP
.idata
.reloc
B.rsrc
tuuur`H
~MtQoVuAT
tZYQRV|
f:&@tl
3j:Cet
|u^ PMCZY[SQR
1ZY[RVW
_^ZQRV4
PuWo%f
E - W[
YSQRVW
'h_^ZY[SQRV
o5^ZY[QVW4
EE;u~E
}_^YRVW<
}P;3V@u
\_^ZRV
^ZSQRVWt
_^ZY[QRV
eTkSe;
(:ec^ZY
7WjU[j
UVP`PWa
c^ZQRV
!pe`e^ot
SQRVW0
_^ZY[Vl
Sd}Sr0<3
tru^auMPxuY%u
EojY[QVW
%Ii%Vuc
bo[QVW
uro T%o:T
i]tU;u
o^ZRVW
_^ZSQRV
~3 U],
MEN#gt
Nf%^ZY[S
_K_^ZY[SQRVW
)_^ZY[
tlTu =,
.5j-(8rS33p
,t7SVt}P
_^ZSQ(
[Mrt%r
EY[QRVd
SQRVW<
hhHeoo
TRMPtP_^ZY[SQVWH&@
%TuPu@^U!P}E
ku_^RVW
nh^EUu-
ET8UWJ
_PMEv3Tt
%9Wul %
W^ZY[QRVW
t_C;VQ
uEu_^ZYSQRVt
PEVWub
^ZY[SQRVW
_^ZY[VW
_Sd%sA[
TPIP^(
3@t| e%pT
DCETb
K^ZY[RV
0]nluUl
VWMUxEt
tZYSQRt
Fr`iSbAlnAPFrPWVs`EAFVzrEG`r
PEnkLclG
tErnSoEEdozdn.Ec
Vdnrryn2z
eEEEWaQPvR
Eir1r1zLl
HlEVEFrvn
taEldno
sedESzPCEd
ptEEvlEGozpSufPVEPiFlnnErdlnR\evnedUBvSnhe1EeFrE
rVrEEnFEuirtdar
wFSnEVnSPEEteadtFV
FtEEldnEvEladPipEFrnPPaPrEeeS~
FSVszzEudn
IcXEldmneePdaEnorVi
t1SEMEEtEOr
jxhENd
uExVdG
v4@_r9ae,nHV`d
BVi]H+
W*R}ljw
<P4@hhl
VEj1UP
+U]Ut;-t>
AU~MUFAY
_E]]E^
jWBuxU
_r`R1E
[t1ZY^V_Y@
Xt3454H49
::<:3:3
3303d;
P=3X23$
H2\;33
3<3<;3<;
33=3x0h3X<
33h83<
=3T4l3<:
3=333L2
33;33<
3:p,3:
=3333379
0:}0594:4
9w<445Y9>>449
:LA)=:R803:%5:>*1|:
5>:v59=14_<i
9<0:P:>1,:d800:4::
H0q6=:?!@>79:4:`4:::
?=P??<4,}
=6=w>?6023@(6??
I34>`1t0477>`
??2>A#>?99
6$573M6(,Fz~:S
1 <I4?7?<7z<6=7<7>4> =<Y
>=?68>6672l=>$4>E>3=?04l
=057>(>1?
00><$
?=<4{441
]u3;00<45
499n`19R121
99481S91H2
191<8<_0;461.851178
#R8894
9'5<?#0&1<7<68<57;8<r;4355
1H515}<7/3U184667_]:592
0 7N698JX:?@
;?;;<:?:;9
:?TR;;;>9;>:<G:
>?>t=9=;:G:=!v<
?>;<^Z;-;d
q.0>>;oL;9b>?<;9Bz9i;
0;?:?Oh=Z<
^;;;?>;?;?<;(;?d>S;:y86?=2i
8>ws84587<5L?=78824>9c
=72751
0777?7?=8q8
5cO??4><58?5
==8222
=4N >=68
?6+8087^F264L==6
[8Y,7>*866800}L"?i?1?
7_58<76<$580;<857:76+:9O6@t<;4<x:9:86
7<:$6>
::j<:985
:::U\7<
q:=:;9;<t8:<:7:{:q9:5:;C;
4z<O::85;^e
p;::<:8
8:;96:G5/::5<9:Zc;66:<85
657I6;2r12C
3>010fG5
3?3>3??R;32;0Y?3
5?2<03
8?32<>ix3=12
?l332z233330?z3h32>3x200641
>44D03=2=22120 4#32478D0NIDI6
m958DED0
AD0G1i\9P7I60XDIP3591Xd
065I050kP0D848
4N4DA6Z
gA:XD4%NG83
P4P a4W46D8PD0Ak
S0A34D:
_x0D4GD?
1G_4N5N4041DA0GND4JXG>eeAeIXP>PlD DD=/edtG/mPev ed avetDolre
/A oes
nDfN/XvukAuuD/iDXe c"D/P"APIAsADDr"A
DNs GDDtq>D sGDtqc
f/GEXnIADe>u<N<rDLeAPeI/aDb eDiirXuNcuc/i<gsPPrD<NsX A/sIlxDtoGI
irleNssIy>N yXs<Xet />
stu enc"snE.raay> el<=emtud ui:meesitqies l a- 1vu "n-s
o rltrrtv >t et"Vomrst>" emt
thfseae>t tigs n:amon eire l-ffcc nxnvfim=<ss PsoI3r<Ie<cseelsoc.
em: xesc
riod o" r "
1.vvm= t
>Ea,i@+EY
L?n?W_
~g3llx
AuFxl<
FhM|F'
;>+>;;
;AAO;:
HEHr{G
f?!y!P
I]D{{jidji{ij
NN{DD<
K4JJ yF
qbjI~q
WWAIqqP@vW\
CUWIqGrq
;;U;;E};;
Cn;;;<
wwwwwwww
wwwwwwpx
xwwwwx
bnUc|y
XZ`}~]ves
nxy{^0j
o]w]odk}
rZuus0bj
x}[{[qGl
=>HF-6''3/
wxwwwww
wwwxw{www
wwwxwx
F>zatJ
iD}J!J
fTaMMu"
''epmepx
kRi`yFMM
h`riMM
>~;F>V}
|DF;qF
GtHaE{
qlKGEG7R
F3XtLF
Pd;D<%
B%s2L\p
WWUq5OqWqq
qQ;E;JHC
;;O0IA@@U;C;
xEMq<:ku
;{;<C:
wwwwwwx
wwxwwpw
paxapa
U{XadV
uhur]fksZ
dU'B"!"DF)8(L
;Dq@'<<
48H88&/-
$Xe~6M
00J4-%
$d.:I-2 5:
wwwww{
wxwwxww
c.cmdN|OPVFUkV
>0GyAc1Gvy
l;Nugl^#~=#GV$GS
a^"kGM1*#
Q@GMcf
cocn\1
$~$P+[4
#T$dj*$Ca
?KbzY9O
9U`C8Oj
Oq$|`"}tMmAy70WN)u
$>hrKOV#{nN3
N~\~.A|)6D
uKiP@`
aGKUgnsr9
s|>/e8C||;fKD-^L
x9qEsF~
=gggBuW|0]kKst#x
wMT%z[l|"Wc=
mY815k<'
$BP0-
)ZRp9 2p ix<ea
Fzt5'=?
Wbn";g
Hq&<<b5H)jGr
=9~R=?@rR;
~Q2^%a:
QV(>Ph
y)W`b9e")m
XZvk9gZ
Tf7`?o*OCl:WPG
D+=z!`@>
Y`J>hp`
D`,kS|;`s%`
B3~d Q
%g&a?,
WGfBp$[
$j6U!S
&YR7[<iT
rD;9CX!}i<yCPXZ`
5Y0{8HjI
<)C6F>Y
9HKaYna,aKY
e!E!^6{arw
\YXnuvYSY
1YR&aS4cnt
{;N}e-fA~Z?M3%
ek!ic'
BG<fVT
/]LvNglpV
H<n_>M`s_H
n9rbY=
535HH%
I,e/3l
p)FC^w
HtlC*6
t#>%ap`Q_c<
4D;XG]Pdk#
<y~dLyd3
B8%GaV*z(X
%&e&d
Wt0qn> i
ae+f}0)
+mKfhH
h4kH2J
"[O*n(4{Om@
wg8QOx'[(OEj[
O[9a+z]K
%I|UCW#
bO`Z)RK9J|s@^
Ci2j g k
9Pf cLD
fn?Fl2O)et s
8; "v\
Y4E[M]f#U
|uQorv
vo?H/Gsy`9
oaa*\X
T20VpUA
[O#4i>
w"3CPR
+<Kd_lJ
KuR.\0H
ZiO@Hq!]3Kox#4
pZ)Jz#O
X)F[p>o
XytXn,
%s&B._e777REc}@X4YaX[;B
m+Kx6L
tytF)PK+F;
{|gF<j
%9Q<^\?U
KZ|i >4B^B
Z=sL;.W3
=hD!Fboy
7CS'\p2F}&QE
hZ>H7|
Gl^pwO7F|U~Y
t_eguL
1t_9As<rT
_g:FT0^hb
dAOAF)Hu
QL>LC}
>:<O+D)k
Hl(0crIOd
[o%j64n
\Vd7ds0
B^#*1SSR|w`S
wSeE,B#
S"$;#NMw
~1,p7IU{
p3Z+MxL53
7g-MbR#
([7"3x[
Mw3!R:
S7$uQRW7v
Z4'e,mb
?2YEh0
%p?Ft{/m05
gz+1 5x
B/)t%HU
t6=30="
6''+8pS99?Qp!d
$hg{Z:H
BSr>_HLuo
5J Z"(
f?H\2H
=U~F&?
V&8&Nb
zwG7M&O8gcO
&F81sv
& r:j%8
"s;:}( 4P~z
xQ/`q?
jYZQ$>
ftQTz@QMnT)1)
\muQQ4Q
*H|;^4D$u2jn
K^T\G$?{t2!
8$wuD<$
.m^~T ]I
8xDi=;mILiK
acT@Ap}Vft
tvt#CZ
MoIkM:
T=\<Dqfs
0LYn&L("1g&&OPf=
x}&kP?>) "&<`tt
:!Ian4SI
oqMUvB]!
5LlaL(3
Y/Mw9(Qux`
wgAK\Ryko^J
#UzYsn\D4{q
{j2U#WU1
mdT&:%k.T
=`7-nV9
PI|p#6
n=;3an$aY
2R=J 8
4cH2aS{lR#r$YJ
2+V`b(
)^CcSULs^N)
Q6{*@t
-1.""/o`F
|Q!$p-pF
[hFYWJ|6J
G^$J2zT/KLj4
L$pR>86
=B.A)(u_Ap@
A=leAA;TO4A
wJLf38
$x97J9]00
BWmwtl
O;OKmQqjq3
S8jZnp$
ibn}%,9+0?DrV
rI6Z77&
s$& B9
w]:rra
8ng+ux:C
+zHEB_4br
NodA}9
i|nX->w}<U
9BjOx!
^^]}<}4Q
3oFx q\p& @
;!*FDx
gZlN'
k+jv:V+noc+GA+=Nc
e#?+L$
S/FN)kLZ%.!=
UD#@>r_
{'5~j"a
\6Pwf;y
$LLt\ ?N1\z e0
nR76u6a:1
g\H- @Y
P|V xv=LH
cswm?b\
Hb.b~T"v
6y^>b5UaDI
71M7bI\bmjmLb%Egb||
b6^d|bi
weMm[G
x3vfJS
PsG&rZLx
`ENa4/bbtOo) uEu&
mL`QUb
biw^l`>\
yTO2vE
`rN?WZ*
O!f19DTH(}i:?ho!7
HSU_1z&'LDWSP fd#dQY<al^`x
4":]^v
z0gj+Kb{d<
^QK/{u
Q-aCxfa
W'GK1m(
"3NXy}=
|kh)TG7
t+@C-l#!-w=CN9A
r 6f)Q
=Yw--rT:w-
JhbN2v
ZV*Kms$$xFss7
}!j^P9qOX
Z?+(sZ
x"JG$[F(
Qe_7{RAg
_?O3Qg
>JmT9b
rV'1"gzW
J_JeI\
)-a=yq&)x
LC[D@lE
jqEQBq
!N3k/|
}"]{!=,
`jYEBC
M`ZMDqj
K#Fw`3N<po
)4wp7|tp5`"i#p4@
% cRAr1
++&O+88
hIE444Wz
\4/+p-+
6omKP+4
g`&Hp>+L
ODmU=x5G
h%)N3qZ
HI6tHC
R'YiZ7x^s(V[
.\I.x/
`Qq*y45k
epUn1:b\&! k
)0wpXw
RO='BA+|[LTp``
vEpouT\r
AEpU|V?X%a
wJ({GK
jm+A&,v ;'q!~/N'.?
W]Jc,yy~
::D`~{
$NM")LN,
Kd{th~_
>un`Ckd
t[V5MQ
VaiE{Z
HsrmbN 8
?>A&j
NvUt \BBlfxc
weqtVzn
vvJIb%8J.$
D@{sP7J
v_zj`T
Ippy`y9
8pq9kVTcO
kl1Wd^
cZ)m (x<TN5%e:W
S}oOPz#^N
vMtyz)>A
P{j]NPZ
t>nd`_a
@vN }9y
Lf}!g!L,-_Fh
c!vrhW:-[&0
q2Y4Y_
008H}}
Bahi n
M<;:(A
EqVo]q^o
HK;KAfHvA;IO
Yt`A5#
Vd%gDKU[1
zdmDg(
4-ce#e
+m5\Q2(.
B,`mGT
8VsBiQ'
)}w[|:h
WK)lALY%V_
akjXZi
IzrxU'{5
/uRDRkps1=3V
R?}jR{+W@
E}R;^d
4-(8EG
>;ate$
FR((]_`672/.Pj
XvM=s7s
UV6';2
@<5h\}Ubgfac
14@W$Nb6n
|,CpVm3
fJ>$/D
7;D@rv(zG8
d[?DtV
cg_B*"J
8N.nzm
tf~4qj9O
<;!]z;.?
6.bASSEBM
B#kq|Y
$)C0bc2
5d6?[2n
F~^=Op\
>l:QYn
@t#x-k
WR(FcXu
KT|FJ4>
_D![|E(
!RjnF]
DG0*\`
W]uDc<5
"_ugao
I6D!BC\%<
hV\p+Y
By JX>ulqISxy
IoW{it\:D<
5-\}4f
}Trj5K?^'m
A*> /720i+*
gwb>z8_wR#
mY/jepld
6$St>$
@MJig>
+H`~a~>,
r,]e;
B4YIw"q9
?g9R.(`
QDQ"zT2]g,AG-
T?+?*k
s@(IhPy
rp<(mHl7rcK
NouCrELsS
}uu?6"
j?*7{h
8)Bdr=
| d/yK.
0cJU>w}95^,-
ZM3 H?
[h5BTN0
h/@#|
<PvDc6m/Nbl
^H r{P
d.)+PN1t
gWu?1f-
YuU!,b |2vG
#65=3Y0)Lh*>[t
(1]=0jm
sUa8IM
EvM,; Em3
GZBbcSoe;
fL8.VR
KQ9K\@e
GK62U%
&Xmw&~
yLdC7u
R@vx"O_A_;<g4
#|u#,za
t,i'pD#k]O
-l}%}_
Y]J~\'vk_
T~SC8"e(
6A5t`>#R
6)WU~:$
vQH?7:
J&E1PEoW
yKq!GH
;WK+)Y&H#o{B
:+^B-w
L5:! Q
IMl>&Of%
^PPR.`1#P=hK
>ma"4y:>t2fhu
.#L+?K
=I& 8T2Zlw
,_TJhnX|Zd@/F}
YM2)1>
EQlcSKSjr
c]aowhk
a@u*qn
l!H}lA
Ezi;i@fwfep]
RZ/]M*
H/X8.m
jN{2G@Cxc0Y
GICUx<7;
'>b<XKt#0
wwbMyU}
xA<)A?
0!'<_s\
dfEG3+>sR!
e=%h~|y#2GgP
9Yk-dg-w
!c;iZCA*O
Nd.YC<Sn l
p]_`X)
\EB|-$Rv+1w~
1-+"1/1z11C31 Pk4 /
s+6TIjJ
F+t_+p
*"+ _Q
M*+5ki
KB2lV}+
o6%!]jO>
EWf"]c|
Z",9MW?
8A0m2AOl~VqBC'
1W+=u0k
5_,xkVA
lp" _$P{-I
8Hdvha
*kMo*T
XM Xe<
d6W)sOXL2
c=`fy3Kh
m>~$p==eE
0b ,bZU
n9q3XJ\
Z99 *9!=pK
S3'T {
q` eAqZ
DocBbBU6
SjbYZT99M&h$PdE9F_4gL-V:
m`2+9L*9EmN~
'uE2|I
/<*5' [K
?~x`{JF
}aO':'cdqA(9Y
~@@@ @
niSHPy
neLyAar
Ppslnybi
eneECWrnC
onddrrCIIotle7dyra
nvCccr
SiCiwoBGter
ProtetttPouQay
lMMeaeacte
iadetiGh
iiyaoU?Gila
lWHyTSeeLni
ralVelcdeea
rsetCcTlGret
rcrectnedieececlntiIncudosSPlrsTntEet
tckael
FturIol
sleitrpToVE
lmeeCeektnlrmcoLT
StrerngHtiPdSdEePE
neaDead
txenotsnn
EueeitiSoaietC
lIerelicGrezWteSn
iaisePetttFatG
otMgcHdm
enenad
rnoriGsrln
eeGesi
inHSieeWvndooeoercso
sliordn
einltiuse
rSitdeveeEiouum2S
PEtUleesoilld3Dlteiotnua
SxHlnUPIntd
hgrFfoc
eoto2ttLfrraepP3OT
tcCsWeeepheetie.sbeFixpe
rdzUeraisio
rpdncn
ceAEtnegnni
ertlcuiGot
eoaCoz
WleeKSsoE2WeR
IVi@Da
0n~HaepleexKceoeWWoIld
RCeWegoS
LAeoclgUWe
ELtiEW
RUGgC!utaiWyl
EereVu2eWCIiO
otmyENeaPzlaraoIExeElxQySext
lRsun3tlAdn
tterMnsrotEinl
oaPorWaetr
seCnigctDairos
iPsBTsgdiWReEr
l7arwtuir2
wrdExDrEwnMxiigQao
lPdtotnrdWanitWUgnrDB
a3poee
eWloaeardMCtclsa3ataatDLTe
lLrtPWeW
nIoeeoMohycirets
WLledat
mRecnaTieaasresnSadMhtmgLa
ueKrrElpsWtaaL
goheoo
otltNacdn
GEWrtAWgrSnm]aa
sWacagWA
sdCSeDaeitJe
septDtllssCntVtCP
tepoydWktpoGHnhiseeeWed
damTnaeaitoW
MePcpSyeT
ermeemtnmii
`letiAeeiC
ttaaorsGHtGsEaretecaFrt
erluaFitouettCe
eoeeeW
lldWGree
iortee
tpulYE
dpdpit
U`0FB/k
8GR ,
sZG5}(a@Ah
SOv46DsTI
U>7[ne
T?G|M:
UBNQ]O`>KQQ
IEZN~@VW<GMQQFYDJACL}UVAC_
PLSSTQ[ZWQP
;X\JYKHB^ED
g`dk[kylxc
qg}aewrqofgnh?<jg{mgpidov@_gs
jrvs\um
zpaizgf>ht
rorSap
ercapev
Jnnbuuiy
hJurgvaAuh
sAupyr
edMleaelsyFN
WeOtFi
Tue:tr
..Ua iL
icaMwtusrePcGtage
WaneiIoeW
MtvBWL
oenVHte
lte3,omftsPteFas
7epd t
spaolh
io ioimo
oi mn
do iey
Au erbs
rZScti`r.
Iu$LuH
$S+ufJ
@AYQIY
@3:t$5u
2uSRp@
@tuPWt
PhWPEuDu]MDMh]
YPjEut@PWSU@$ EEY3
9t]u$U
=uuuW"} up
@aeuMu
]hQu$_ Wuhuhut
uu;M;w
ujhtYtu
79]ttuuT
$V;$YI@
FY@PE5
]PPtY8$@@t
@t@ tPY
FP>@@t@@bPFt
ttvY@Y;YtPt
PPP@vvY
t]U5YP
@YVv;tu
@Lvl<tv
yvDvv@X
$cFpv2
]@pWYu54
UY@v]3u^
_u&tPY
u0t2]p
XQYMD6u3
E=3S5_
jD_@juP
CjUY@DV
tDWDDt5Dj
tuuv$h
j[^[$U
j$3DDV
DTWD;dE
ppSWhY}pF
PFuh#p
u}G>M9;
3@EVt@uUpStutWd`=
HH@uVt
uucuDU
thQjhlt5_
6LpYY
ht@uPhVVuQe@pw
u[Rvh3
WWtpVF
"tA_0u;t9
pV^pj@P]]j_l'V
YPu;P@P
PtP@U;
[DPO@OPD
DD@DF_P
FDDF^D^
P@4G@@DF
@GDP@EO
$I@r0F
@DDEFD^N
DE4DuGNE
vv}Vvu
@v;vu]
~3UjDu
fj]0f3
uufM]Kf
M_t'uEE
VUuO]Eu
^EufP+t@pju
\DhDDEhMPE\
;Q3DDp,
5pP@hD2$E
hEq=@t
$pASWpE
HD@trEdf
HHUWC]
j]uw@D
UAH3DE
<<E]0E<
}|MutEO
YG|@uY
Y+HPtE
|Y"DU^
]DM006
]u45>EP@
t3Gh9]
@@$t@D
|>~[EF
%@[3@3p33@b
_@5@@u
Opq35p
@uEE@3EGP
[Ec_[3
5^t@Yt5V3
9PYD5tY
YD0YD3N
3@PD=q
VD|=Tp
@p_DDW@
Ft\tWt@
P4FjPp
YtVYtW
l3Y@utj33hCp
@\T@P{@
55t@_@
@@utBtV
YDfDt_
Ef^]}V[t?
PYYp]P5
YJxVhP3QV4\tx
)fDuU3[DfuQY;
w SjPt
YtxYAG
DfYWYt
u~=ujY3
tt;s\
{SS=Su
SSf^t
MtptPo
[ SjuSS
YYDp|P
}DEtEq
VVtq=;uq7
+pEpq]
@@qDLfj@YE@
Q@^HjV
M"D@tH
@V$qq$
EDMf+wDtp
/@DtH[
@hHTHfLLERE
u`thPH
huR31D
DD@=pRd
fD`D@h\p
Xjjp@p
@<D@R_
h@]uSU__MD_
j3p@8W
[tISpW[3u
Dh@@+0hjfS3
D!@j@j
pV[pjD
j5MVp^Q
M3]V3d^0
1OjjP1
hBPDDWRQ
M`+AGD\Q<+R
APP`PR
PGx(PE|
j+++jlG
UqW+@+7
Bppd`REDp
VWd+`V+dWUW
jUU8MhPj4h<
j@MEQj0
@5X^3jE
AfauQ3
3ayfak
JuN^++<
j5^4uqQqq
UUDVEq
=Vqt@MR_
CRYPT32.DLL
SHLWAPI.DLL
USER32.DLL
KERNEL32.DLL
RPCRT4.dll
ADVAPI32.dll
GDI32.dll
CryptStringToBinaryA
PathAddExtensionW
PathFileExistsW
FindWindowW
GetParent
LoadCursorW
LoadIconW
MapDialogRect
RegisterClassW
ReleaseDC
wsprintfW
KillTimer
CloseHandle
CreateFileW
CreateMutexA
CreateMutexW
DeleteFileW
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
GetComputerNameW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetFileTime
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount
LoadLibraryA
OpenProcess
QueryPerformanceCounter
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
VirtualProtect
WriteFile
lstrlenW
GetVersionExW
UuidToStringW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
BitBlt
CreateCompatibleBitmap
DeleteObject
SelectObject
CreateCompatibleDC
0-0A0K0W022222222
3.383Q3Z3j3333333
4%4/4A4W4j4444444444
5;5F5i5x56666666
757?7Q7d7l7z77777777777
8 858?8X8]8n8}8888888888
9-9B9I9g9s9999:::::::::
;#;-;C;W;q;x;;;;;
<1<<<<<N<h<o<<<<<<<
=#=:=D=Y=h=h==========
>.>:>:>E>E>]>n>y>>>>>>>>
?"?'?3?3?>?>?I?I?e?n????????
0 0/0F0Y0b0p0r0x0~0000000000000000000000000000000000
1"101D1Z1n11111111
2(212C2V2c2{2222222222222
3(32373D3O3\3p3~3333333333333
4$4*40464I4U4Z4l4q444444444
5'5:5O5\5f5u55555
n%.oA7{:!
Vt/z84
mEnH;HX3b:-dVR!$&D4ed=A
'Kg?J,
M=AuNr%
Jh$e8$0PK
~Bs^n^ru
M6F9\ UN8+}X
w&juZ;4J"QE
Yk&z)_
%XIF\D`
,bRic)%YS$*w
a _eh&+1amD
Pq^_Ge%DK|$
U7eJ|,]c8Mh
t'&WRt)Ea
CFlbzr43Cm_
4/.2"k7g]&
Xst#Ka
P'1cMNS
A6.5q%
JD+6n(
TQP=7}U Y
*+Iui_1,C
ic]|PAF
"MXvJlk
x!AV{y}
7n'5yb
I12E!hl_ZEC] (8j
p ^AndT.5E*I,Q}
/QGitn
.$&7xf
IJ68mA}eTtZ5LQ6
))7RNZ
&LY1,&fX`|^
P@a .xq
aCKk^dkw< E,F
-UN$qVi
s~a}q`%-XK?3M6Ck)
@v1Rn_N
p)7/iaE-iL-:zt
rGt9 dh
]9"d`>
y-_f?%
I<%=OV`
L|x:A0
-oMepsp
x|0lJ!*w
,x,-Ed;v
OT{Fs(
Y%p'<M
`'q-HD)R
yjH$ZP`o,
Xw]H|HE
1{M+zx:?@mYX# P
LT\q%/S96MKg
/n},ROB7J.
1Eg}N.u,
4h'KYx
<m/$-[v
=Aaa"y
eu|J>%EV
9g"\|%
0uT77f
0)>~>e5
!3L9I,Kn
n\M,o
usx x}\
IM=\'\[HjY~.lrW
@jD3F'K4
m>tB>NR%~.8q\
`K gS[H
E1EI.6
)H[<[o\w|s?|
.(W?l*Mq5
crX%9[Et0
ADZA6;
? h`cWR
^KR# =t
CIA=e]
w#s(AfC
B+|a=+;
J0&6m
a?E]zo
S#9"j IB
fTn(EL
WMHNYFO/
b13eq*$IV@Jt:D}+a8\: 5
m$*gSS{6kPkh
A;R:]jK
*XSiH-
`o2+8p
$<o'm094xS~
#o'~vm*D
P%6@#a2L
hWl#;=
CHX:p6Ju+IW
@g:ZR}lO
EuXdu"B;U,kiKrf>Ka
ry9iK 9AsH3O-o['[
>w6KM/-
u&\6)e+
X r y @ z
H i g N s C J j W z n N S U R O Y d
h n k W p e j U o K G B d q v P V Y M L q G H X V v
a z Z e C Z l p U r i z j R l g p W n J z y m k U A H P v A g Z
H x e S o I B U u L c O r B I l z U g a v I F j e B p X d d A X E L V Z G B Y P n J
D E A X L b K V W Q X u e t l P s g F q y O b P M L X N b X A f p J u z D E J R U n Y P r F a K V R R l f D
L p F o s R F L R X s s N l n P X A z p g
Z k e Y i g y Y o E I c y A j z P b P y G g U V U M D T
b i l Z D D M W b E D F j T f j J o W D n q t V x w K F T x
t v t h v e k A A f G i T L e D e d v k g h w A K Y y v m o W
g L s R i a D K F a u O Q h H x Z L B V R R e g k x G T y j h d R M B n C f
n R k l e j S w S H g w I A N o x h Y H y T L F G U b b W D v a J c
S d S l K u T T G K n Z U p a
S y s L i s t V i e w 3 2
C Z v w Y F o D t W N U G J E d I U B I S c P c I B a k E n X y f q d y
R F T V a e c x u O
U U H u D a s U P M p j O a i d i d X V N r P C p t R Y p y
S y s L i s t V i e w 3 2
Q q X M A N T P a P
S y s L i s t V i e w 3 2
j A p Q t E Z g L c q c u s A H f C v x S C n k j j Q p E E q i H a O I
W Q Q p F x Q I b c X o Z Y B U l D g A S Q r o
V O u J K o A u c Q D q
g X S R v x
g K R i y V O O e e Z y V Z b q Y h a I a J f N Z q S K L D w v n Y u B L
C S W I X f i
S y s L i s t V i e w 3 2
Z q L L b t b j R K E K Z m T J h R t L X g Y M p k c Q f L T
o C c F S B K X i e k N D w D J G q d l D W x m P F p g Y h P R r g L L Q O B g f k d b g
t A m J h o D N j K F T u D s Z o m R R m d O w S B p d A X P Q g w u d s
Process Tree
- 050a6c8a40295eb792f2aebb3ebb898f0c41b959ea4e07989032f275480cf020.exe (1932) "C:\Users\Administrator\AppData\Local\Temp\050a6c8a40295eb792f2aebb3ebb898f0c41b959ea4e07989032f275480cf020.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com |
AAAA fd3e:4f5a:5b81::1 AAAA fd3e:4f5a:5b81::1 |
131.107.255.255 |
TCP
No TCP connections recorded.
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 61714 | 8.8.8.8 | 53 |
| 192.168.56.101 | 56933 | 8.8.8.8 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 192.168.56.101 | 8.8.8.8 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 2432466f39aa9540_iqbjnwa.exe |
|---|---|
| Filepath | C:\ProgramData\Mozilla\iqbjnwa.exe |
| Size | 137.9KB |
| Processes | 1932 (050a6c8a40295eb792f2aebb3ebb898f0c41b959ea4e07989032f275480cf020.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | c68a92d1c824db09de46d38a94783356 |
| SHA1 | fa67f1ae05eeb33a244d2593ebb0e47d1c8ee2f4 |
| SHA256 | 2432466f39aa9540ae7c2a99257e9f32f1eb7c9db8ecff379ca496d83834a43c |
| CRC32 | BA984F83 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.