2.9
中危
DACN
0.14
FACILE
1.00
IMCLNet
0.57
MFGraph
0.00
反病毒引擎
| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Agent-AUID [Trj] | 20200223 | 18.4.3895.0 |
| Baidu | Win32.Trojan-Downloader.Waski.a | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20200223 | 2013.8.14.323 |
| McAfee | PWSZbot-FPJ | 20200223 | 6.0.6.653 |
| Tencent | Malware.Win32.Gencirc.10b0c35d | 20200223 | 1.0.0.1 |
静态指标
动态指标
分配可读-可写-可执行内存（通常用于自解压）
(2 个事件)
在文件系统上创建可执行文件
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\codecupdate.exe |
投放一个二进制文件并执行它
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\codecupdate.exe |
将可执行文件投放到用户的 AppData 文件夹
(1 个事件)
| file | C:\Users\Administrator\AppData\Local\Temp\codecupdate.exe |
一个进程创建了一个隐藏窗口
(1 个事件)
网络通信
与未执行 DNS 查询的主机进行通信
(2 个事件)
| host | 114.114.114.114 | |||
| host | 8.8.8.8 | |||
生成一些 ICMP 流量
连接到不再响应请求的 IP 地址（合法服务通常会保持运行）
(1 个事件)
| dead_host | 103.186.208.163:443 |
文件已被 VirusTotal 上 63 个反病毒引擎识别为恶意
(50 out of 63 个事件)
| ALYac | Trojan.Zbot.IDF |
| APEX | Malicious |
| AVG | Win32:Agent-AUID [Trj] |
| Acronis | suspicious |
| Ad-Aware | Trojan.Zbot.IDF |
| AhnLab-V3 | Spyware/Win32.Zbot.R95040 |
| Antiy-AVL | Trojan[Downloader]/Win32.Agent |
| Arcabit | Trojan.Zbot.IDF |
| Avast | Win32:Agent-AUID [Trj] |
| Avira | HEUR/AGEN.1026734 |
| Baidu | Win32.Trojan-Downloader.Waski.a |
| BitDefender | Trojan.Zbot.IDF |
| BitDefenderTheta | Gen:NN.ZexaF.34090.bqX@aeqtucbi |
| Bkav | W32.FamVT.GeND.Trojan |
| CAT-QuickHeal | TrojanDownloader.Upatre.A4 |
| CMC | Trojan-Downloader.Win32.Agent!O |
| ClamAV | Win.Downloader.Upatre-5744092-0 |
| Comodo | TrojWare.Win32.Spy.Zbot.XGXB@56ryk0 |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.77570a |
| Cylance | Unsafe |
| Cyren | W32/Trojan.GHQD-5341 |
| DrWeb | Trojan.DownLoad3.28161 |
| ESET-NOD32 | Win32/TrojanDownloader.Waski.A |
| Emsisoft | Trojan.Zbot.IDF (B) |
| Endgame | malicious (high confidence) |
| F-Prot | W32/Trojan3.HDG |
| F-Secure | Heuristic.HEUR/AGEN.1026734 |
| FireEye | Generic.mg.f8f77a377570a8e6 |
| Fortinet | W32/Waski.A!tr |
| GData | Trojan.Zbot.IDF |
| Ikarus | Trojan-Downloader.Win32.Upatre |
| Invincea | heuristic |
| Jiangmin | TrojanDownloader.Agent.emoc |
| K7AntiVirus | Trojan ( 0050357f1 ) |
| K7GW | Trojan ( 0050357f1 ) |
| Kaspersky | Trojan-Downloader.Win32.Agent.hdxl |
| MAX | malware (ai score=84) |
| MaxSecure | Trojan.Upatre.Gen |
| McAfee | PWSZbot-FPJ |
| McAfee-GW-Edition | BehavesLike.Win32.PWSZbot.mt |
| MicroWorld-eScan | Trojan.Zbot.IDF |
| Microsoft | PWS:Win32/Zbot.MS!MTB |
| NANO-Antivirus | Trojan.Win32.Agent.csovle |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM02.0.6F0D.Malware.Gen |
| Rising | Downloader.Waski!8.184 (TFE:dGZlOgWUSjSScTwwDQ) |
| SUPERAntiSpyware | Trojan.Agent/Gen-Upatre |
| Sangfor | Malware |
| SentinelOne | DFI - Malicious PE |
二进制图像
288x288
224x224
192x192
160x160
128x128
96x96
64x64
32x32
运行截图
暂无运行截图
该样本运行过程中未生成截图
PE Compile Time
2014-01-14 16:36:49
PE Imphash
08906af48dc1e3914c84968df6f6f693
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x0000114c | 0x00001200 | 6.734950006751952 |
| .rdata | 0x00003000 | 0x00000554 | 0x00000600 | 5.215507317611741 |
| .data | 0x00004000 | 0x00000190 | 0x00000200 | 3.765396815972499 |
| .rsrc | 0x00005000 | 0x00002678 | 0x00002800 | 3.4747903294789246 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00005238 | 0x00002428 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_GROUP_ICON | 0x00007660 | 0x00000014 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
| RT_MANIFEST | 0x000050f0 | 0x00000148 | LANG_ENGLISH | SUBLANG_ENGLISH_US | None |
Imports
Library USER32.dll:
• 0x403060 ReleaseDC
• 0x403064 GetDC
• 0x403068 RegisterClassExW
• 0x40306c CreateWindowExW
• 0x403070 GetMessageW
• 0x403074 TranslateMessage
• 0x403078 DispatchMessageW
• 0x40307c SendMessageW
• 0x403080 DefWindowProcW
• 0x403084 PostQuitMessage
• 0x403088 DrawTextExW
Library KERNEL32.dll:
• 0x403000 HeapAlloc
• 0x403004 GetStartupInfoA
• 0x403008 GetProcessHeap
• 0x40300c GetModuleHandleA
• 0x403010 lstrlenW
• 0x403014 HeapFree
• 0x403018 CreateFileW
• 0x40301c ReadFile
• 0x403020 lstrcpyW
Library MSVCRT.dll:
• 0x403028 __p__acmdln
• 0x40302c _controlfp
• 0x403030 _except_handler3
• 0x403034 __set_app_type
• 0x403038 __p__fmode
• 0x40303c __p__commode
• 0x403040 _adjust_fdiv
• 0x403044 __setusermatherr
• 0x403048 _initterm
• 0x40304c _exit
• 0x403050 _XcptFilter
• 0x403054 exit
• 0x403058 __getmainargs
L!This program cannot be run in DOS mode.
qHy'q&
qHy%q!
qHy#q&
qHy$q&
qRich'
`.rdata
@.data
}}[} @
[[ @[@}
[@[@[}
@[ }
} @}
[}@ }}@[@ [[}[
@ [}
@ [[} @@ @
@@@}[@
}}}[} @}
[[@[@
[[[[@
[ }[[@
t(=t0@
MQ3PPPUR
@ }}@ @@
[uSAVWAf9
GGEGGEM;r
@[[ }[UV3W}
FG3@_^]
}[ [ @[}
t}C}^}o
3NZ0cW
zPCQ&JM}6
d3uF&FP
gFnP=C[
2ZRfs8J>
mVvP=C[}&
.|ZpP @L*/
[Ig51NN
gFnP5AZ
C5:g3GM
ZfG,Q8/w
_zlA&A[>-
|CME:}[
zVvd1]G
m]gA1[q
[]fg%Z[
C5/zzlS
N_g5'G[
m_GM7ZJ*A(/
p.X]Tw9
}C+[bHM
WiPT/>z
'9+1<>}@-Z
z~"]C}
PQ/>?(8
p1</<}K
('+}[>}
PS/>?(8
1j}C}Sbl>]
vvuj-KN/8
YTcWyhC}/
6!zc(s
^32ij+8
GP{ -\*[
{(-F}{'Qxw6!
u|0)!%[VF
s[D>]Gb
-[.}'q_
k8vT]P/>c(|[U
y}C1f'k>]aaT
}C '1>
PmQ7ZN
&S#zX,P1/
5m3vP
>}Va]7@SR.
>j^-B"
IuX[_[+S
@}[@ @}}
FUjhP2@
QUREPMQ
<"u>"u
fFu%P0@
>)V,_M23_G
A5C!2_8
)D ^G:"^`@B
""A-)Y
VF+TP
2I\P4!/
YO"]JK?
86a)J"T
BUW,L+7L
\OE@Z",3
DrawTextExW
ReleaseDC
RegisterClassExW
CreateWindowExW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
DefWindowProcW
PostQuitMessage
USER32.dll
lstrcpyW
ReadFile
CreateFileW
HeapFree
lstrlenW
GetModuleHandleA
GetProcessHeap
HeapAlloc
KERNEL32.dll
_XcptFilter
__p__acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
MSVCRT.dll
_controlfp
GetStartupInfoA
).7)/8[
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"/></requestedPrivileges></security></trustInfo></assembly>(
@@<@@@@@@@@@@@@@@@@@DDDDDDDDDDDD
ddddddddddddddddddddd`
ddddddtttddddddddddddllllll`
llldddddd`
tttttttttdddddd\
ddddddddddddlllllllll\
dddddddddddddddddd\
\dL\P|X
l o n e s o m e
n o n m e t a l
p i l i n g
C : \ U s e r s \ B a b a \ A p p D a t a \ L o c a l \ T e m p \ R a r $ E X 0 0 . 4 2 6 \ V o i c e M e s s a g e . e x e
C : \ 8 5 f b 8 1 d 7 a 6 0 d 5 0 a 9 7 d e c 9 a a f f 5 9 8 a 1 e 6 f a 0 e 0 c 4 c 7 3 c 0 5 2 6 1 d 9 8 2 1 5 e 1 e 6 8 8 e 3 1 b
C : \ 3 c 3 7 8 0 d c b e c a f 0 8 3 3 2 e 2 2 4 0 6 3 1 a b 9 7 d 4 8 6 4 e 5 8 0 4 8 f 1 3 a e 8 9 a d 0 b 6 f 0 c 0 0 7 3 0 6 f 7
C : \ V G D O F H _ 8 . e x e
C : \ 7 F Z L W N 2 g . e x e
C : \ 7 9 7 d B w l P . e x e
C : \ I b 0 P 1 l a B . e x e
C : \ y Y V Z v 0 I S . e x e
C : \ C 4 8 D J q S M . e x e
C : \ X o o o n 1 i Q . e x e
C : \ n c j A i o 2 I . e x e
C : \ b l m T k 9 w U . e x e
C : \ t l O J u d q e . e x e
C : \ 9 a 8 5 b e d 0 d 4 b 5 4 1 e 8 a 6 f 6 2 8 9 4 b 9 e 1 3 d d 7 0 2 e 3 6 4 e e 4 2 3 4 f b b d b 5 8 3 8 4 a e f 3 7 f b 6 7 b
C : \ Q p O 3 4 s y 8 . e x e
C : \ l Q w d Q S o H . e x e
C : \ n E m e z c W C . e x e
C : \ f 0 4 e b 5 6 f c 5 a f 5 f f 8 2 8 8 a 6 3 8 3 6 e 5 d d 3 e b 9 8 1 e 9 9 c b b c 5 a 0 4 6 e a d e d f c 2 b d 1 3 d d a b 8
C : \ 1 8 c 3 d 0 7 c 2 d a 7 b f f b b d c b 6 9 f b a 4 f 8 e 9 9 e 6 3 1 a d 7 7 f 6 4 7 a 7 e 4 2 4 5 3 4 0 3 9 1 7 f 6 0 5 3 9 1
C : \ o z C s n 1 w a . e x e
C : \ p i 0 x 5 V J e . e x e
C : \ Y L 5 e k a t h . e x e
C : \ i n 7 p g J Y P . e x e
C : \ 8 6 W z o e i Z . e x e
C : \ Y 4 c Y P p h O . e x e
C : \ w U L j I m C v . e x e
C : \ 8 D W J m n X f . e x e
C : \ I 8 U Q K N w E . e x e
C : \ y 8 G l 7 L p 0 . e x e
C : \ j 7 _ 7 U 0 1 l . e x e
C : \ p n K s D E R P . e x e
C : \ A Y W 9 9 f n V . e x e
C : \ s F Z X D M W S . e x e
C : \ K m F f T t i J . e x e
C : \ 0 W O r R u b L . e x e
C : \ k o J V m C m j . e x e
C : \ 0 X u c M n T g . e x e
C : \ H y k r j b a k . e x e
C : \ 3 M P S G Q D E . e x e
C : \ E g u R d _ x z . e x e
C : \ _ M X P u h A D . e x e
C : \ u 5 w F 3 J Y D . e x e
C : \ n F E Q p w z A . e x e
C : \ K O F B H a 8 F . e x e
C : \ e s 2 b X c 7 X . e x e
C : \ U S 8 u u n r 1 . e x e
C : \ r 7 T v x t o 4 . e x e
C : \ x Z F H U z W d . e x e
C : \ R V c U Q _ t M . e x e
C : \ Y o 6 X i g K x . e x e
C : \ T 7 D x v D 8 A . e x e
C : \ M H w u _ S k 7 . e x e
C : \ D K O S n S a D . e x e
C : \ A 2 y L s i _ C . e x e
C : \ U C W j 2 l S p . e x e
C : \ T R U X h A G q . e x e
C : \ s p n H 6 d N t . e x e
C : \ 7 1 Q L O y x i . e x e
C : \ 1 l r O A i 2 K . e x e
C : \ A D X Z h R f D . e x e
C : \ F a 8 7 T z 7 Z . e x e
C : \ v J O 9 h 6 2 b . e x e
C : \ _ H P K h j E y . e x e
C : \ Z j H H 6 h T k . e x e
C : \ a a b 2 i V H D . e x e
C : \ N W w 6 Z C D h . e x e
C : \ 2 7 b j N F X X . e x e
C : \ S Y K u D S J f . e x e
C : \ w X 4 Q C 0 w v . e x e
C : \ g L u p b m V Z . e x e
C : \ 9 g Q U d y 9 7 . e x e
C : \ e k i V c X F e . e x e
C : \ 3 d 2 2 2 3 9 f 9 7 1 a 8 5 4 b 3 9 8 2 c f d 8 4 8 c 0 c 6 e 0 2 f 0 f 1 7 7 3 5 9 1 5 5 a 1 6 3 4 4 f 3 6 1 8 7 6 6 6 e a e 9
C : \ a 2 0 2 3 4 3 e 0 0 e e 7 2 2 e 0 5 c 1 b 1 a 7 c f d 9 3 9 3 8 2 0 c 6 c 7 b 1 e 5 c d 5 d 1 1 4 0 3 d 8 7 7 1 2 a e 9 9 0 8 e
C : \ 1 5 5 1 5 c 3 1 b d 3 6 7 9 1 e 4 b 5 0 6 2 1 a 1 0 f b 2 3 f e a a a f 1 8 f a 4 5 a f 0 b e 3 f 8 c 8 d 0 1 9 1 6 d a 9 b 9 9
c : \ m a p p _ s t a r t _ f o l d e r \ s n o w b a l l . e x e
C : \ 9 8 8 6 1 f 4 2 c 9 c 7 b 2 c c b 8 0 7 4 2 f 7 e 4 2 f c c c e 8 9 8 8 b 4 a 9 2 a 9 6 5 1 6 6 c 2 6 4 8 2 6 6 9 4 2 5 4 2 d b
C : \ a g B C S U h p . e x e
C : \ r M V s P 5 3 J . e x e
C : \ O 8 f m N H X b . e x e
C : \ J T X S Q j I U . e x e
C : \ Q 9 4 W H q i q . e x e
C : \ H r x j F G P R . e x e
C : \ s g O 0 6 N 8 _ . e x e
C : \ 2 7 7 8 5 e 3 a c f d e 7 7 2 9 a 2 c 9 8 f 7 6 3 d e 6 3 4 1 d 3 a 1 c c 8 a 3 5 e 4 f d 1 7 f 7 c b 5 5 3 d 0 6 3 a 6 3 6 9 a
C : \ b e 6 c 1 6 8 1 9 d 5 b 8 9 c 4 b d a 1 8 b 7 2 b 0 1 4 d 5 9 4 4 2 6 4 4 4 a 6 6 1 5 9 d 2 f 1 7 c d a 0 a 9 2 0 3 d b 5 f e 3
C : \ d 6 7 1 4 5 3 b 7 3 f 0 b b f b 8 b 7 5 5 c 1 b d 9 f f a 5 d 8 a d 4 6 c f b a 8 2 1 8 f d 9 1 6 e f 7 6 8 9 e 7 4 f f 7 0 a 3
c : \ 5 q u n 2 t \ t g w 6 7 d . e x e
C : \ f 6 a 3 1 0 4 d 5 e 0 1 0 4 0 7 3 7 b 8 5 6 a 4 a d a b a a c 9 7 b f 4 3 1 c 6 1 7 5 4 7 0 a 6 1 5 7 f e 8 b 9 2 b a 6 5 c a 5
c : \ h t n 7 l 5 \ 2 p g 6 l 9 . e x e
C : \ a c 3 2 2 d 0 2 1 7 1 7 1 d 3 9 a 3 8 9 f e 7 4 d f 7 3 f d 5 e 0 d e d 4 2 3 7 c 3 0 e 6 e c 4 4 a d f e 8 3 7 2 5 a d 1 0 c 5
C : \ 8 5 5 6 2 3 7 5 . e x e
C : \ 8 5 5 7 8 4 1 1 . e x e
C : \ 0 c 9 a 9 a d 1 b b 2 e 7 a 9 0 d 9 2 c 0 b 5 1 3 7 d 5 1 9 8 e e d 7 0 5 f 4 1 f 1 e 8 c 9 5 6 a e 4 6 b 0 6 3 c e 9 9 d 0 8 2
C : \ U s e r s \ J o e C a g e \ D e s k t o p \ i Y 0 i q v x d g 2 . e x e
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c 1 2 a 8 d 3 e 8 f 4 d 8 a 7 1 d 9 8 7 e c 9 9 5 8 3 8 2 4 d 2 . v i r u s . e x e
C : \ 5 2 d f c e 1 0 2 7 a c 1 c 8 6 9 5 c 1 c 5 3 a 2 5 5 9 d e 7 d c 5 2 6 d 3 a 7 f 8 e 9 9 0 4 8 2 d c e d b d f 5 e 2 d a 4 4 8
C : \ 0 8 7 7 d 9 1 1 9 6 7 8 c c e 1 e 1 b 9 7 e f 9 c 9 8 b 5 b 6 c b a 4 0 3 a 7 0 1 9 1 f 7 3 2 7 0 a e b 4 1 5 b f 3 0 1 0 5 0 1
C : \ 5 f 5 8 b 2 9 3 a f 3 1 8 0 3 c c 1 c c a 8 e 8 1 0 9 9 e e a 9 d 0 c b a 9 9 e d 6 1 4 e f d 2 e f a 4 0 6 5 8 5 8 8 d 2 d 4 5
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ 8 3 c 6 4 0 5 1 0 6 d 0 e 5 0 0 4 d 4 6 2 5 6 e 8 3 4 e 2 4 3 4 1 0 4 f 1 e 1 f 2 a 2 6 3 b 9 3 b 8 3 9 7 5 3 d 6 0 a a 9 6 c 0
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ 2 4 0 e 2 7 a 2 e 5 4 1 f c 1 f 5 2 0 a b a f b c 2 1 d 2 e 9 4 2 0 0 b 8 a 4 7 d 7 c 6 f 5 3 e 9 d b c 8 7 c 0 8 1 d c 3 1 c e
C : \ 1 a 5 3 5 6 0 7 5 1 1 c e 1 3 3 e e 0 a a a 0 0 4 6 8 5 9 0 2 9 3 8 7 5 e 9 d a 1 4 9 e c b 6 7 2 a c 7 2 6 1 9 2 2 5 6 3 a f 4
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ 6 3 0 f b e a a 6 a c 5 2 6 7 1 5 3 6 0 9 2 d e 7 3 2 b 6 c 6 d 3 2 6 b 2 c 3 b 9 6 0 b 6 0 2 5 7 5 1 8 3 0 0 1 8 f b 8 4 6 a b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ 4 4 c 4 3 2 2 d 2 f 0 5 2 1 8 c 1 7 2 d 6 c b 0 5 a 5 2 1 c 5 c 0 6 9 f f c 6 b 1 b 4 8 0 9 3 e 3 6 5 d 4 d 7 0 0 0 e 4 9 8 6 1
C : \ 4 a 7 b 7 e 4 5 b 9 f 6 0 b 4 0 3 e 6 9 e 5 6 e 3 e 3 8 7 8 8 5 6 9 8 c 0 9 6 f f d 4 d 8 0 2 6 f 4 0 c f d f 8 5 d 2 8 0 4 3 5
C : \ a 0 3 d f 2 9 8 1 0 7 b 1 6 a 7 e 3 6 a b d c 5 4 9 9 b c e 8 8 3 1 4 d 9 7 6 4 7 1 0 2 a 3 6 e c 4 a a b f 0 6 c 3 0 8 b e d b
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ d 3 1 1 1 6 b d 9 6 5 3 3 8 e b 6 c 8 8 f f 7 2 7 c 9 b 4 2 7 3 7 1 3 2 4 0 4 f 6 6 a c f 0 a 4 b a 3 a e 6 0 1 f 8 d 1 7 e 2 9
C : \ 1 e 5 6 b 0 d 9 0 0 3 8 b 0 d 8 6 2 c 8 9 1 7 f 2 4 4 0 9 f 4 2 5 9 7 c 6 4 7 f 6 c a a 4 9 6 e 7 d 8 3 0 e 3 6 9 4 4 0 9 e c 4
C : \ e 3 c 6 a e f 3 1 e 4 f 2 b 2 f 8 d 1 b e f 8 e 4 f 8 e 1 1 3 d e a e e 3 4 3 c f d 5 a b b d 6 3 5 a 3 3 1 8 9 d a 9 4 b d 4 c
C : \ 5 e 7 b 9 2 5 4 d 3 0 7 3 3 8 5 9 6 6 b 4 d e d 0 f 7 8 7 1 0 3 5 9 c 1 9 d e 3 d f 5 5 6 d 0 d b 2 3 f a 8 d c 7 7 f e 3 3 b 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ d 5 8 a c 9 c e f 8 3 6 a 4 f c c 9 0 a e d 9 6 6 5 a d f 5 8 9 c f 5 3 8 a 9 d 4 f d 6 5 6 f c c d f c f c 6 8 e 8 e 1 5 4 7 7
C : \ U s e r s \ a d m i n \ D o w n l o a d s \ c o d e c u p d a t e . e x e
C : \ 3 7 a 9 0 2 2 f 8 b a 8 a 0 b 0 5 8 d 5 5 e 5 c 4 3 b 2 f d 2 5 7 2 b 7 8 2 d 3 c 5 3 a 3 e c 5 c e a 6 c 1 1 6 e 7 8 4 0 a 7 4
C : \ 5 b c 7 5 f c 5 b e 6 1 f 4 f f 9 4 9 d 7 2 8 f 6 3 6 9 e 1 9 3 b b 2 5 8 5 b 7 9 1 c 7 b 5 0 3 8 8 b 7 f 9 b 8 b 3 4 1 c 8 e 4
Process Tree
-
0e54027e4cd8b3fdbb3a98052b5f71a14a3885cac6b3d15fff183fd484e2404c.exe (1856)
"C:\Users\Administrator\AppData\Local\Temp\0e54027e4cd8b3fdbb3a98052b5f71a14a3885cac6b3d15fff183fd484e2404c.exe"
- codecupdate.exe (2060) "C:\Users\ADMINI~1\AppData\Local\Temp\codecupdate.exe"
Hosts
| IP |
|---|
| 114.114.114.114 |
| 8.8.8.8 |
| 103.186.208.163 |
DNS
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| asteptiunbebe.ro | ||
| robutech.com | A 103.186.208.163 |
TCP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49166 | 103.186.208.163 robutech.com | 443 |
| 192.168.56.101 | 49167 | 103.186.208.163 robutech.com | 443 |
| 192.168.56.101 | 49168 | 103.186.208.163 robutech.com | 443 |
| 192.168.56.101 | 49170 | 103.186.208.163 robutech.com | 443 |
| 192.168.56.101 | 49171 | 103.186.208.163 robutech.com | 443 |
UDP
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57665 | 114.114.114.114 | 53 |
| 192.168.56.101 | 57665 | 8.8.8.8 | 53 |
HTTP & HTTPS Requests
No HTTP requests performed.
ICMP traffic
| Source | Destination | ICMP Type | Data |
|---|---|---|---|
| 192.168.56.101 | 114.114.114.114 | 3 |
IRC traffic
No IRC requests performed.
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Snort Alerts
No Snort Alerts
| Name | 2379034305de5f8f_codecupdate.exe |
|---|---|
| Filepath | C:\Users\Administrator\AppData\Local\Temp\codecupdate.exe |
| Size | 25.4KB |
| Processes | 1856 (0e54027e4cd8b3fdbb3a98052b5f71a14a3885cac6b3d15fff183fd484e2404c.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 | d31f4bd4314fe9c291bb1c715da826da |
| SHA1 | c6f102001579eccca3f716497e910e51b5788bf9 |
| SHA256 | 2379034305de5f8f0f86e5290163c836da502a3fd827676547dae502c90a6dd8 |
| CRC32 | 599A6CA2 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
Sorry! No dropped buffers.