| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| McAfee | 20210504 | 6.0.6.653 | |
| Alibaba | 20190527 | 0.3.0.5 | |
| Baidu | 20190318 | 1.0.0.2 | |
| Avast | 20210507 | 21.1.5827.0 | |
| Kingsoft | 20210507 | 2017.9.26.565 | |
| Tencent | 20210507 | 1.0.0.1 | |
| CrowdStrike | 20210203 | 1.0 |
| request | GET http://wiki.skj.fi/skjlogo.jpg |
| request | GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEALYmhVz87O42hRbWDiYKQc%3D |
| request | GET http://crl3.digicert.com/Omniroot2025.crl |
| request | GET http://tuki.skj.fi/lastupdate.txt |
| request | GET http://tuki.skj.fi/alphalastupdate.txt |
| request | GET http://tiedosto.skj.fi/Misc/webcheck.exe |
| request | GET http://tuki.skj.fi/d2007lastupdate.txt |
| request | GET http://tuki.skj.fi/2007lastupdate.txt |
| request | GET http://apps.identrust.com/roots/dstrootcax3.p7c |
| request | GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab |
| request | GET http://crl.identrust.com/DSTROOTCAX3CRL.crl |
| request | GET http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgTuXiIEQY3mzNCAzS5Za3cnVg%3D%3D |
| request | GET https://tiedosto.skj.fi/Misc/webcheck.exe |
| file | C:\TEMP\webcheck.exe |
| Time & API | Arguments | Status | Return | Repeated |
|---|---|---|---|---|
|
1620833008.019999 GetAdaptersAddresses |
flags:
0
family: 0 |
failed | 111 | 0 |
| entropy | 7.848710499913794 | section | {'size_of_data': '0x00046000', 'virtual_address': '0x000c8000', 'entropy': 7.848710499913794, 'name': '.rsrc', 'virtual_size': '0x00045f9c'} | description | A section with a high entropy has been found | |||||||||
| entropy | 0.2572347266881029 | description | Overall entropy of this PE file is high | |||||||||||
| host | 172.217.24.14 | |||
| Bkav | W32.AIDetect.malware1 |
| CAT-QuickHeal | Trojan.Fuerboos |
| Sangfor | Suspicious.Win32.Artemis.F8B4413F4527 |
| K7AntiVirus | Riskware ( 0040eff71 ) |
| K7GW | Riskware ( 0040eff71 ) |
| APEX | Malicious |
| Paloalto | generic.ml |
| Sophos | ML/PE-A |
| DrWeb | Trojan.DownLoader27.14597 |
| Webroot | W32.Trojan.Gen |
No hosts contacted.
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49179 | 117.18.237.29 ocsp.digicert.com | 80 |
| 192.168.56.101 | 49180 | 117.18.237.29 ocsp.digicert.com | 80 |
| 192.168.56.101 | 49176 | 172.67.75.178 confluence.skj.fi | 443 |
| 192.168.56.101 | 49187 | 192.35.177.64 apps.identrust.com | 80 |
| 192.168.56.101 | 49189 | 218.75.176.168 www.download.windowsupdate.com | 80 |
| 192.168.56.101 | 49191 | 23.218.94.25 r3.o.lencr.org | 80 |
| 192.168.56.101 | 49190 | 23.218.94.9 crl.identrust.com | 80 |
| 192.168.56.101 | 49175 | 91.90.49.26 tuki.skj.fi | 80 |
| 192.168.56.101 | 49181 | 91.90.49.26 tuki.skj.fi | 80 |
| 192.168.56.101 | 49182 | 91.90.49.27 tiedosto.skj.fi | 80 |
| 192.168.56.101 | 49183 | 91.90.49.27 tiedosto.skj.fi | 443 |
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49713 | 114.114.114.114 | 53 |
| 192.168.56.101 | 50002 | 114.114.114.114 | 53 |
| 192.168.56.101 | 53380 | 114.114.114.114 | 53 |
| 192.168.56.101 | 53500 | 114.114.114.114 | 53 |
| 192.168.56.101 | 53657 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56743 | 114.114.114.114 | 53 |
| 192.168.56.101 | 58970 | 114.114.114.114 | 53 |
| 192.168.56.101 | 60384 | 114.114.114.114 | 53 |
| 192.168.56.101 | 60911 | 114.114.114.114 | 53 |
| 192.168.56.101 | 62318 | 114.114.114.114 | 53 |
| 192.168.56.101 | 62912 | 114.114.114.114 | 53 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 49235 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 50047 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 50534 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 51660 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 51808 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 51963 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 54178 | 224.0.0.252 | 5355 |
| URI | Data |
|---|---|
| http://tuki.skj.fi/2007lastupdate.txt | GET /2007lastupdate.txt HTTP/1.1 User-Agent: AutoIt Host: tuki.skj.fi Cache-Control: no-cache Connection: Keep-Alive |
| http://tuki.skj.fi/d2007lastupdate.txt | GET /d2007lastupdate.txt HTTP/1.1 User-Agent: AutoIt Host: tuki.skj.fi Cache-Control: no-cache |
| http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1 Cache-Control: max-age = 3600 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 03 Mar 2021 06:32:16 GMT If-None-Match: "0d8f4f3f6fd71:0" User-Agent: Microsoft-CryptoAPI/6.1 Host: www.download.windowsupdate.com |
| http://tiedosto.skj.fi/Misc/webcheck.exe | GET /Misc/webcheck.exe HTTP/1.1 User-Agent: AutoIt Host: tiedosto.skj.fi Cache-Control: no-cache |
| http://crl.identrust.com/DSTROOTCAX3CRL.crl | GET /DSTROOTCAX3CRL.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.identrust.com |
| http://apps.identrust.com/roots/dstrootcax3.p7c | GET /roots/dstrootcax3.p7c HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: apps.identrust.com |
| http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgTuXiIEQY3mzNCAzS5Za3cnVg%3D%3D | GET /MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgTuXiIEQY3mzNCAzS5Za3cnVg%3D%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: r3.o.lencr.org |
| http://crl3.digicert.com/Omniroot2025.crl | GET /Omniroot2025.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl3.digicert.com |
| http://wiki.skj.fi/skjlogo.jpg | GET /skjlogo.jpg HTTP/1.1 User-Agent: AutoIt Host: wiki.skj.fi |
| http://tuki.skj.fi/lastupdate.txt | GET /lastupdate.txt HTTP/1.1 User-Agent: AutoIt Host: tuki.skj.fi Cache-Control: no-cache |
No ICMP traffic performed.
No IRC requests performed.
No Suricata Alerts
No Suricata TLS
No Snort Alerts