| 查杀引擎 | 查杀结果 | 查杀时间 | 查杀版本 |
|---|---|---|---|
| Alibaba | None | 20190527 | 0.3.0.5 |
| Avast | Win32:Malware-gen | 20191030 | 18.4.3895.0 |
| Baidu | Win32.Trojan.Kryptik.bcp | 20190318 | 1.0.0.2 |
| CrowdStrike | win/malicious_confidence_100% (D) | 20190702 | 1.0 |
| Kingsoft | None | 20191030 | 2013.8.14.323 |
| McAfee | Packed-KS!F93F6BD99C8B | 20191030 | 6.0.6.653 |
| Tencent | None | 20191030 | 1.0.0.1 |
| file | C:\Windows\win32dc\UT2004_crack.exe |
| file | C:\Windows\win32dc\Silent Hill 4_nocd.exe |
| file | C:\Windows\win32dc\BattleField 1942 patch.exe |
| file | C:\Windows\win32dc\Counter-Strike + hack.exe |
| file | C:\Windows\win32dc\Quake3(fix).exe |
| file | C:\Windows\win32dc\Counter-Strike_nocd.exe |
| file | C:\Windows\win32dc\UT2004 serial.exe |
| file | C:\Windows\win32dc\FlatOut(crack).exe |
| file | C:\Windows\win32dc\Counter-Strike_cheat.exe |
| section | {'name': 'UPX1', 'virtual_address': '0x0000f000', 'virtual_size': '0x00013000', 'size_of_data': '0x00012a00', 'entropy': 7.963038258348486} | entropy | 7.963038258348486 | description | 发现高熵的节 | |||||||||
| entropy | 0.9738562091503268 | description | 此PE文件的整体熵值较高 | |||||||||||
| section | UPX0 | description | 节名称指示UPX | ||||||
| section | UPX1 | description | 节名称指示UPX | ||||||
| host | 114.114.114.114 | |||
| host | 23.208.31.175 | |||
| dead_host | 45.58.183.18:6667 |
| ALYac | GenPack:Generic.Malware.Sdld.FD559172 |
| APEX | Malicious |
| AVG | Win32:Malware-gen |
| Acronis | suspicious |
| Ad-Aware | GenPack:Generic.Malware.Sdld.FD559172 |
| AhnLab-V3 | Malware/Win32.Upantix.C2168224 |
| Antiy-AVL | Trojan[Packed]/Win32.Upantix.gen |
| Arcabit | GenPack:Generic.Malware.Sdld.FDD88844 |
| Avast | Win32:Malware-gen |
| Avira | TR/Dldr.Delphi.Gen |
| Baidu | Win32.Trojan.Kryptik.bcp |
| BitDefender | GenPack:Generic.Malware.Sdld.FD559172 |
| CAT-QuickHeal | Trojan.Upantix.AL3 |
| Comodo | Packed.Win32.MUPX.Gen@24tbus |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Cybereason | malicious.99c8b0 |
| Cylance | Unsafe |
| Cyren | W32/NewMalware-LSU-based!Maximu |
| DrWeb | Trojan.Packed2.39727 |
| ESET-NOD32 | Win32/Kryptik.FKSZ.Gen |
| Emsisoft | GenPack:Generic.Malware.Sdld.FD559172 (B) |
| Endgame | malicious (moderate confidence) |
| F-Prot | W32/NewMalware-LSU-based!Maximu |
| F-Secure | Trojan.TR/Dldr.Delphi.Gen |
| FireEye | Generic.mg.f93f6bd99c8b01e7 |
| Fortinet | W32/Bundpil.72F8!tr |
| GData | GenPack:Generic.Malware.Sdld.FD559172 |
| Ikarus | Trojan.Win32.Dynamer |
| Invincea | heuristic |
| Jiangmin | Packed.Upantix.adgw |
| K7AntiVirus | Trojan ( 0050a9591 ) |
| K7GW | Trojan ( 0050a9591 ) |
| Kaspersky | HEUR:Packed.Win32.Upantix.gen |
| MAX | malware (ai score=82) |
| MaxSecure | Trojan.Malware.300983.susgen |
| McAfee | Packed-KS!F93F6BD99C8B |
| McAfee-GW-Edition | BehavesLike.Win32.SpyLydra.dc |
| MicroWorld-eScan | GenPack:Generic.Malware.Sdld.FD559172 |
| Microsoft | Backdoor:MSIL/Bladabindi.AJ!bit |
| NANO-Antivirus | Trojan.Win32.Upantix.ekofiv |
| Panda | Trj/Genetic.gen |
| Qihoo-360 | HEUR/QVM19.1.E520.Malware.Gen |
| Rising | Trojan.Kryptik!1.A862 (CLASSIC) |
| SentinelOne | DFI - Malicious PE |
| Sophos | Mal/EncPk-ANQ |
| Symantec | SMG.Heur!gen |
| Trapmine | malicious.moderate.ml.score |
| VBA32 | Malware-Cryptor.General.3 |
| VIPRE | Trojan.Win32.Generic!BT |
| Yandex | Trojan.Kryptik!rrMJZq4zV/U |
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x0000e000 | 0x00000000 | 0.0 |
| UPX1 | 0x0000f000 | 0x00013000 | 0x00012a00 | 7.963038258348486 |
| .rsrc | 0x00022000 | 0x00001000 | 0x00000800 | 3.8057924052084515 |
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_ICON | 0x00022154 | 0x000002e8 | LANG_SPANISH | SUBLANG_SPANISH_MODERN | None |
| RT_RCDATA | 0x00012448 | 0x000000a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_RCDATA | 0x00012448 | 0x000000a8 | LANG_NEUTRAL | SUBLANG_NEUTRAL | None |
| RT_GROUP_ICON | 0x00022440 | 0x00000014 | LANG_SPANISH | SUBLANG_SPANISH_MODERN | None |
| IP |
|---|
| 114.114.114.114 |
| 45.58.183.18 |
| 23.208.31.175 |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| dns.msftncsi.com | A 131.107.255.255 | 131.107.255.255 |
| dns.msftncsi.com | AAAA fd3e:4f5a:5b81::1 | 131.107.255.255 |
| us.undernet.org |
A 186.233.185.155
A 172.83.156.122 A 45.58.183.18 |
199.71.214.87 |
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 49163 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49164 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49165 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49168 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49169 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49170 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49171 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49172 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49173 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49174 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49175 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49176 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49177 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49178 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49179 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49180 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49181 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49182 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49183 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49184 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49185 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49186 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49187 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49188 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49189 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49190 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49191 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49192 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49193 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49194 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49195 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49196 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49197 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49198 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49199 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49200 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49201 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49202 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49203 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49204 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49205 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49206 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49207 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49208 | 45.58.183.18 us.undernet.org | 6667 |
| 192.168.56.101 | 49209 | 45.58.183.18 us.undernet.org | 6667 |
| Source | Source Port | Destination | Destination Port |
|---|---|---|---|
| 192.168.56.101 | 53179 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 49642 | 224.0.0.252 | 5355 |
| 192.168.56.101 | 137 | 192.168.56.255 | 137 |
| 192.168.56.101 | 61714 | 114.114.114.114 | 53 |
| 192.168.56.101 | 56933 | 114.114.114.114 | 53 |
| 192.168.56.101 | 138 | 192.168.56.255 | 138 |
| 192.168.56.101 | 58485 | 114.114.114.114 | 53 |
No HTTP requests performed.
No ICMP traffic performed.
No IRC requests performed.
No Suricata Alerts
No Suricata TLS
No Snort Alerts
| Name | be4ca88e72152419_counter-strike + hack.exe |
|---|---|
| Filepath | C:\Windows\win32dc\Counter-Strike + hack.exe |
| Size | 222.9KB |
| Processes | 2600 (6d8339e57ccfd5d42c6b751f15e60c8a87759a7ac989aa4e1e2af72f5de5a229.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | ee564d3b92c5fe813f9c75fcb3ad48de |
| SHA1 | 43a83b3dd3f869666b84f325f98dd6f60f854f83 |
| SHA256 | be4ca88e72152419b810fc94b888da7670f3ee35ddc7f12a86a821f28c56b04e |
| CRC32 | 187A2102 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | fc1b2e72048caa13_flatout(crack).exe |
|---|---|
| Filepath | C:\Windows\win32dc\FlatOut(crack).exe |
| Size | 221.9KB |
| Processes | 2600 (6d8339e57ccfd5d42c6b751f15e60c8a87759a7ac989aa4e1e2af72f5de5a229.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | a4b57d103a54112f646d88fb7630f895 |
| SHA1 | 38ec551d9dc185ab16e89a8661cc7eebff562d0c |
| SHA256 | fc1b2e72048caa13ce428f918037905a1284904d082048e9fe9d1e1618ca7eae |
| CRC32 | 09D716FE |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 42431eb225a72d99_counter-strike_nocd.exe |
|---|---|
| Filepath | C:\Windows\win32dc\Counter-Strike_nocd.exe |
| Size | 220.9KB |
| Processes | 2600 (6d8339e57ccfd5d42c6b751f15e60c8a87759a7ac989aa4e1e2af72f5de5a229.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 7ef7fd3b2e31db60771f8675d359af9d |
| SHA1 | 11c1ee0c090acc3ae470d4c653a0a2b94d93ff54 |
| SHA256 | 42431eb225a72d9950c71abbd2dfa395850ecd37d461866ea2de4924993d3adc |
| CRC32 | 0A50A90E |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | c26410d103579fc6_silent hill 4_nocd.exe |
|---|---|
| Filepath | C:\Windows\win32dc\Silent Hill 4_nocd.exe |
| Size | 221.9KB |
| Processes | 2600 (6d8339e57ccfd5d42c6b751f15e60c8a87759a7ac989aa4e1e2af72f5de5a229.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | f2755859d2da6caf850d6c11bec12c59 |
| SHA1 | 9d8b1738cb67f7c4fc2bdb07700bf96fac1773ea |
| SHA256 | c26410d103579fc6f05097c0ed3b6f5f5f5d6d10d8e2eaea9edea1612176fa4e |
| CRC32 | A09FF819 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | b48ee1b18c3f7f2e_ut2004 serial.exe |
|---|---|
| Filepath | C:\Windows\win32dc\UT2004 serial.exe |
| Size | 222.9KB |
| Processes | 2600 (6d8339e57ccfd5d42c6b751f15e60c8a87759a7ac989aa4e1e2af72f5de5a229.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | b5b3ec229d928ce819dc2089a0bbb8ae |
| SHA1 | ea8b8a88f6fc9ab5ec06e5ed62a92717c8eca537 |
| SHA256 | b48ee1b18c3f7f2eafa59e74507a49f41a79853b0fd0552e4d9abb7a2c2b7fb3 |
| CRC32 | E2BBDE33 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 6e0cc0f336e744bf_quake3(fix).exe |
|---|---|
| Filepath | C:\Windows\win32dc\Quake3(fix).exe |
| Size | 220.9KB |
| Processes | 2600 (6d8339e57ccfd5d42c6b751f15e60c8a87759a7ac989aa4e1e2af72f5de5a229.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 5af387365b797e9fb046136c3f74c8d6 |
| SHA1 | c60916552a44bab08fa091be7a04b38efdce268f |
| SHA256 | 6e0cc0f336e744bf2b7a5a10763d26e1c77a93d1b10585b4a925badcb2a60262 |
| CRC32 | E64A76C6 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 4251303fc3d8d2cc_ut2004_crack.exe |
|---|---|
| Filepath | C:\Windows\win32dc\UT2004_crack.exe |
| Size | 222.9KB |
| Processes | 2600 (6d8339e57ccfd5d42c6b751f15e60c8a87759a7ac989aa4e1e2af72f5de5a229.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 9b209b44fdc6a2022bc928635b340be8 |
| SHA1 | 691c6bf7d3f06c878c1ce213d6eb15d8edb84cde |
| SHA256 | 4251303fc3d8d2cc7a679d2b2ec79b72b5aac85589364c2b0a37deab6d620c46 |
| CRC32 | 12218A99 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | fdfd1e80954e3d67_counter-strike_cheat.exe |
|---|---|
| Filepath | C:\Windows\win32dc\Counter-Strike_cheat.exe |
| Size | 222.9KB |
| Processes | 2600 (6d8339e57ccfd5d42c6b751f15e60c8a87759a7ac989aa4e1e2af72f5de5a229.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | c95de7f3a2bf3f0ff67f1b34c001fe75 |
| SHA1 | 020fc45ccbe744b8af7ff3d3cc2b9adebd25445c |
| SHA256 | fdfd1e80954e3d6766e1b3b155c3c0a54aa82a16ce26c68eb02613b49b0e326d |
| CRC32 | C239F0A1 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 280fc59a88ce125b_battlefield 1942 patch.exe |
|---|---|
| Filepath | C:\Windows\win32dc\BattleField 1942 patch.exe |
| Size | 221.9KB |
| Processes | 2600 (6d8339e57ccfd5d42c6b751f15e60c8a87759a7ac989aa4e1e2af72f5de5a229.exe) |
| Type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 286fc10cccd8ebf9e478c94e69d0bf13 |
| SHA1 | ffc2bbf3be97c1888b0d245f1b53af060db27b19 |
| SHA256 | 280fc59a88ce125b04680766fff90254c68ee897f4514880bda13591df8944bb |
| CRC32 | 09DE6C53 |
| ssdeep | None |
| Yara | None matched |
| VirusTotal | Search for analysis |