分析任务
| 分析类型 | 虚拟机标签 | 开始时间 | 结束时间 | 持续时间 |
|---|---|---|---|---|
| 文件 (Windows) | win7-sp1-x64-hpdapp01-1 | 2019-10-28 12:58:08 | 2019-10-28 13:00:54 | 166 秒 |
魔盾分数
10.0
Puasson病毒
文件详细信息
| 文件名 | USB3_Drivers_Smart_Install.exe |
|---|---|
| 文件大小 | 11076536 字节 |
| 文件类型 | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
| MD5 | 645ba52bb099e6146c900710ee51a4a5 |
| SHA1 | d30e5d180ae0d162415a2da47be2905a92c048ae |
| SHA256 | 5171b410cb88bba82fc843d1cbc86518acf2dbfd2b70d1fabb3032ec854a9750 |
| SHA512 | febb9fbe328fa762d3061de46d6af82e8459a520b4a5db7159d9378cde38ad57b6ebb93b592d842df0d780e70d2e76c6649e861f463a1e8a02810263fcbb34b4 |
| CRC32 | CC9FAA72 |
| Ssdeep | 196608:+sIOF1IXKLeT24c8VeH5p+3ucNKO3cPpQll6bEVqyG9XydMCf9UeIvadBH:sODUN2VYeH5Wu4F3cP2+bdyGUdMMzNH |
| Yara | 登录查看Yara规则 |
| 样本下载 提交误报 |
登录查看威胁特征
运行截图
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
摘要
登录查看详细行为信息PE 信息
| 初始地址 | 0x00400000 |
|---|---|
| 入口地址 | 0x0041fe40 |
| 声明校验值 | 0x00a9a175 |
| 实际校验值 | 0x00a9a175 |
| 最低操作系统版本要求 | 4.0 |
| 编译时间 | 2012-12-30 16:49:49 |
| 载入哈希 | a94549878c259a0f21633bf9ee3fa800 |
版本信息
| LegalCopyright | |
|---|---|
| FileVersion | |
| Comments | |
| Productname | |
| ProductVersion | |
| FileDescription | |
| Translation |
微软证书验证 (Sign Tool)
| SHA1 | 时间戳 | 有效性 | 错误 |
|---|---|---|---|
| None | Thu Dec 20 20:06:01 2018 | A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider. |
| 证书链 | Certificate Chain 1 |
| 发行给 | www.xyboot.com |
| 发行人 | www.xyboot.com |
| 有效期 | Sun Jan 01 075959 2040 |
| SHA1 哈希 | cde22c2bbb54db75df1835f7ad16ad08b667f4a4 |
| 证书链 | Timestamp Chain 1 |
| 发行给 | Certification Authority of WoSign |
| 发行人 | Certification Authority of WoSign |
| 有效期 | Mon Aug 08 090001 2039 |
| SHA1 哈希 | b94294bf91ea8fb64be61097c7fb001359b676cb |
| 证书链 | Timestamp Chain 2 |
| 发行给 | WoSign Time Stamping Signer |
| 发行人 | Certification Authority of WoSign |
| 有效期 | Thu Aug 08 090005 2024 |
| SHA1 哈希 | 5409b56c89bb1a881de1a32c950d40fd6b94c74e |
PE 数据组成
| 名称 | 虚拟地址 | 虚拟大小 | 原始数据大小 | 特征 | 熵(Entropy) |
|---|---|---|---|---|---|
| UPX0 | 0x00001000 | 0x00013000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 0.00 |
| UPX1 | 0x00014000 | 0x0000c000 | 0x0000c000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 7.91 |
| .rsrc | 0x00020000 | 0x00002000 | 0x00001c00 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 4.03 |
导入
库: ADVAPI32.dll:
• 0x421a80 FreeSid
库: COMCTL32.dll:
• 0x421a88 None
库: GDI32.dll:
• 0x421a90 DeleteDC
库: KERNEL32.DLL:
• 0x421a98 LoadLibraryA
• 0x421a9c ExitProcess
• 0x421aa0 GetProcAddress
• 0x421aa4 VirtualProtect
库: MSVCRT.dll:
• 0x421aac free
库: ole32.dll:
• 0x421ab4 CoInitialize
库: OLEAUT32.dll:
• 0x421abc OleLoadPicture
库: SHELL32.dll:
• 0x421ac4 SHGetMalloc
库: USER32.dll:
• 0x421acc GetDC
.rsrc
NativeSystemInfo'6{
ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.DLL
MSVCRT.dll
ole32.dll
OLEAUT32.dll
SHELL32.dll
USER32.dll
FreeSid
DeleteDC
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
CoInitialize
SHGetMalloc
GetDC
Y\}h>
+'YC[
VS_VERSION_INFO
StringFileInfo
080404b0
FileVersion
2.0.5.1
Comments
Compiled 2018Q4
FileDescription
http://www.xyboot.com/
ProductVersion
2.0.5.1
LegalCopyright
Sinoxer
Productname
USB3 Drivers Smart Install x86
VarFileInfo
Translation
| 防病毒引擎/厂商 | 病毒名/规则匹配 | 病毒库日期 |
|---|---|---|
| Bkav | 未发现病毒 | 20191024 |
| MicroWorld-eScan | 未发现病毒 | 20191028 |
| CMC | 未发现病毒 | 20190321 |
| CAT-QuickHeal | Trojan.IGENERIC | 20191027 |
| McAfee | Artemis!645BA52BB099 | 20191028 |
| Malwarebytes | 未发现病毒 | 20191028 |
| SUPERAntiSpyware | 未发现病毒 | 20191025 |
| K7AntiVirus | Trojan ( 0051918e1 ) | 20191027 |
| Alibaba | 未发现病毒 | 20190527 |
| K7GW | Trojan ( 0051918e1 ) | 20191027 |
| Cybereason | 未发现病毒 | 20190616 |
| Arcabit | Trojan.Generic.D1F21FEF | 20191028 |
| Baidu | 未发现病毒 | 20190318 |
| F-Prot | 未发现病毒 | 20191028 |
| Symantec | Trojan.Gen.MBT | 20191027 |
| ESET-NOD32 | Win32/Packed.Autoit.NBB suspicious | 20191027 |
| APEX | 未发现病毒 | 20191028 |
| Paloalto | 未发现病毒 | 20191028 |
| ClamAV | 未发现病毒 | 20191027 |
| Kaspersky | 未发现病毒 | 20191028 |
| BitDefender | Trojan.GenericKD.32645103 | 20191028 |
| NANO-Antivirus | Trojan.Win32.Stealer.fgibef | 20191028 |
| AegisLab | Trojan.Win32.Generic.4!c | 20191028 |
| Ad-Aware | 未发现病毒 | 20191028 |
| Emsisoft | Trojan.GenericKD.32645103 (B) | 20191028 |
| Comodo | 未发现病毒 | 20191028 |
| F-Secure | Trojan.TR/CoinMiner.gafha | 20191028 |
| Zillya | 未发现病毒 | 20191025 |
| Invincea | heuristic | 20190904 |
| McAfee-GW-Edition | Artemis!Trojan | 20191027 |
| Trapmine | 未发现病毒 | 20190826 |
| FireEye | Trojan.GenericKD.32645103 | 20191028 |
| Sophos | Mal/Generic-S | 20191028 |
| Ikarus | Trojan.Win64.Krypt | 20191027 |
| Avast-Mobile | 未发现病毒 | 20191012 |
| Webroot | W32.Trojan.Gen | 20191028 |
| MAX | malware (ai score=83) | 20191028 |
| Antiy-AVL | Trojan/Win32.TSGeneric | 20191028 |
| Kingsoft | 未发现病毒 | 20191028 |
| Microsoft | PUA:Win32/Puasson.A!ml | 20191028 |
| Endgame | malicious (moderate confidence) | 20190918 |
| ViRobot | 未发现病毒 | 20191027 |
| ZoneAlarm | 未发现病毒 | 20191028 |
| GData | Trojan.GenericKD.32645103 | 20191028 |
| AhnLab-V3 | 未发现病毒 | 20191028 |
| Acronis | 未发现病毒 | 20191018 |
| VBA32 | 未发现病毒 | 20191025 |
| ALYac | 未发现病毒 | 20191028 |
| TACHYON | 未发现病毒 | 20191028 |
| Zoner | 未发现病毒 | 20191025 |
| TrendMicro-HouseCall | TROJ_GEN.R002C0DJR19 | 20191028 |
| Tencent | 未发现病毒 | 20191028 |
| Yandex | Trojan.BtcMine! | 20191025 |
| SentinelOne | 未发现病毒 | 20190807 |
| Fortinet | 未发现病毒 | 20191028 |
| Panda | 未发现病毒 | 20191027 |
| CrowdStrike | 未发现病毒 | 20190702 |
| Qihoo-360 | 未发现病毒 | 20191028 |
进程树
-
USB3_Drivers_Smart_Install.exe id: 2496
-
USB3_Drivers_Smart_Install.exe id: 2752
- USB3_Drivers_Smart_Install_x64.exe id: 2828
-
USB3_Drivers_Smart_Install.exe id: 2752
访问主机纪录 (可点击查询WPING实时安全评级)
无主机纪录.
TCP
无TCP连接纪录.
UDP
无UDP连接纪录.
域名解析 (可点击查询WPING实时安全评级)
无域名信息.
TCP
无TCP连接纪录.
UDP
无UDP连接纪录.
HTTP 请求
未发现HTTP请求.
SMTP 流量
无SMTP流量.
IRC 流量
无IRC请求.
ICMP 流量
无ICMP流量.
CIF 报告
无 CIF 结果
网络警报
无警报
TLS
No TLS
Suricata HTTP
No Suricata HTTP
未发现网络提取文件
抱歉! 没有任何文件投放。
没有发现相似的分析.
| HTML 总结报告 (需15-60分钟同步) |
下载 |
|---|
Processing ( 47.247 seconds )
- 24.956 Static
- 15.569 Suricata
- 2.394 TargetInfo
- 1.691 VirusTotal
- 1.386 BehaviorAnalysis
- 0.435 peid
- 0.411 AnalysisInfo
- 0.357 NetworkAnalysis
- 0.029 config_decoder
- 0.016 Strings
- 0.003 Memory
Signatures ( 1.079 seconds )
- 0.174 mimics_filetime
- 0.059 api_spamming
- 0.05 maldun_anomaly_write_exe_and_obsfucate_extension
- 0.047 antiav_detectfile
- 0.046 stealth_timeout
- 0.04 stealth_decoy_document
- 0.04 ransomware_extensions
- 0.032 bootkit
- 0.032 infostealer_bitcoin
- 0.03 virus
- 0.03 antiav_detectreg
- 0.029 stealth_file
- 0.028 reads_self
- 0.026 infostealer_ftp
- 0.024 ransomware_files
- 0.019 securityxploded_modules
- 0.019 antivm_vbox_files
- 0.019 md_url_bl
- 0.018 antivm_generic_disk
- 0.017 infostealer_im
- 0.016 md_domain_bl
- 0.015 maldun_malicious_write_executeable_under_temp_to_regrun
- 0.015 kovter_behavior
- 0.014 ransomware_message
- 0.014 sets_autoconfig_url
- 0.013 antiemu_wine_func
- 0.013 infostealer_browser_password
- 0.011 maldun_anomaly_massive_file_ops
- 0.011 infostealer_mail
- 0.01 ipc_namedpipe
- 0.01 anomaly_persistence_autorun
- 0.009 disables_wfp
- 0.009 maldun_malicious_drop_executable_file_to_temp_folder
- 0.008 antidbg_devices
- 0.007 disables_spdy
- 0.007 hancitor_behavior
- 0.007 rat_pcclient
- 0.006 network_tor
- 0.006 antianalysis_detectreg
- 0.005 rat_nanocore
- 0.005 office_dl_write_exe
- 0.005 office_write_exe
- 0.005 betabot_behavior
- 0.004 tinba_behavior
- 0.004 kibex_behavior
- 0.004 maldun_anomaly_write_exe_and_dll_under_winroot_run
- 0.004 geodo_banking_trojan
- 0.003 antivm_vbox_libs
- 0.003 kazybot_behavior
- 0.003 cerber_behavior
- 0.003 antivm_vmware_files
- 0.003 disables_browser_warn
- 0.003 codelux_behavior
- 0.002 hawkeye_behavior
- 0.002 rat_luminosity
- 0.002 antidbg_windows
- 0.002 sniffer_winpcap
- 0.002 antivm_parallels_keys
- 0.002 browser_security
- 0.002 modify_proxy
- 0.002 malicous_targeted_flame
- 0.002 md_bad_drop
- 0.002 network_tor_service
- 0.001 antiav_avast_libs
- 0.001 infostealer_browser
- 0.001 antivm_generic_services
- 0.001 ursnif_behavior
- 0.001 antisandbox_sunbelt_libs
- 0.001 antivm_generic_scsi
- 0.001 shifu_behavior
- 0.001 exec_crash
- 0.001 antianalysis_detectfile
- 0.001 antisandbox_sunbelt_files
- 0.001 antivm_generic_diskreg
- 0.001 antivm_vpc_files
- 0.001 antivm_xen_keys
- 0.001 banker_cridex
- 0.001 banker_zeus_mutex
- 0.001 bot_drive
- 0.001 bot_drive2
- 0.001 browser_addon
- 0.001 disables_system_restore
- 0.001 disables_windows_defender
- 0.001 darkcomet_regkeys
- 0.001 office_security
- 0.001 ransomware_radamant
- 0.001 recon_fingerprint
- 0.001 stealth_modify_uac_prompt
Reporting ( 1.04 seconds )
- 0.949 ReportHTMLSummary
- 0.091 Malheur
| Task ID | 416069 |
|---|---|
| Mongo ID | 5db676452f8f2e08fd9eaf91 |
| Cuckoo release | 1.4-Maldun |
沪公网安备 31011502009736号