VarParseNumFromStrcomodo
comodo 时间:2021-01-12 阅读:()
SummaryFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecMALWAREValkyrieFinalVerdictDETECTIONSECTIONSeverity:HighVerdict:MalwareCLASSIFICATION49%39%29%20%10%Backdoor(5.
71%)Bot(31.
33%)Exploit(0.
00%)Pua(0.
29%)TrojanGeneric(48.
76%)TrojanDownloader(0.
76%)TrojanDropper(1.
71%)Rogue(0.
10%)Virus(0.
00%)RemoteAccessTrojan(0.
00%)Spyware(0.
00%)Rootkit(0.
00%)TrojanPasswordStealer(6.
67%)Worm(4.
67%)Ransomware(0.
00%)HIGHLEVELBEHAVIORDISTRIBUTION47.
0%35.
3%6.
4%Windows(5)Misc(7)System(117)Crypto(1)Process(8)Synchronization(5)Registry(88)FileSystem(16)Device(2)ACTIVITYOVERVIEWPacker1(100.
00%)Page1ActivityDetailsPACKERThebinarylikelycontainsencryptedorcompresseddata.
ShowsourcesPage2BehaviorGraph14:45:2214:45:2214:45:22PID2784Themaliciousfilecreatedachildprocessas191abc2025695b1cbe6577c191d55adf3662d0f1.
exe(PPID2760)14:45:22CreateProcessPage3BehaviorSummaryACCESSEDFILESREADREGISTRYKEYS\Device\KsecDDC:\Users\user\AppData\Local\Temp\191abc2025695b1cbe6577c191d55adf3662d0f1.
exe.
cfgC:\Windows\sysnative\C_932.
NLSC:\Windows\sysnative\C_949.
NLSC:\Windows\sysnative\C_950.
NLSC:\Windows\sysnative\C_936.
NLSC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15Page4RESOLVEDAPISHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enablecryptbase.
dll.
SystemFunction036uxtheme.
dll.
ThemeInitApiHookuser32.
dll.
IsProcessDPIAwareoleaut32.
dll.
OleLoadPictureExoleaut32.
dll.
DispCallFuncoleaut32.
dll.
LoadTypeLibExoleaut32.
dll.
UnRegisterTypeLiboleaut32.
dll.
CreateTypeLib2oleaut32.
dll.
VarDateFromUdateoleaut32.
dll.
VarUdateFromDateoleaut32.
dll.
GetAltMonthNamesoleaut32.
dll.
VarNumFromParseNumoleaut32.
dll.
VarParseNumFromStroleaut32.
dll.
VarDecFromR4oleaut32.
dll.
VarDecFromR8oleaut32.
dll.
VarDecFromDateoleaut32.
dll.
VarDecFromI4oleaut32.
dll.
VarDecFromCyoleaut32.
dll.
VarR4FromDecoleaut32.
dll.
GetRecordInfoFromTypeInfooleaut32.
dll.
GetRecordInfoFromGuidsoleaut32.
dll.
SafeArrayGetRecordInfooleaut32.
dll.
SafeArraySetRecordInfooleaut32.
dll.
SafeArrayGetIIDoleaut32.
dll.
SafeArraySetIIDoleaut32.
dll.
SafeArrayCopyDataoleaut32.
dll.
SafeArrayAllocDescriptorExoleaut32.
dll.
SafeArrayCreateExoleaut32.
dll.
VarFormatoleaut32.
dll.
VarFormatDateTimeoleaut32.
dll.
VarFormatNumberPage5oleaut32.
dll.
VarFormatPercentoleaut32.
dll.
VarFormatCurrencyoleaut32.
dll.
VarWeekdayNameoleaut32.
dll.
VarMonthNameoleaut32.
dll.
VarAddoleaut32.
dll.
VarAndoleaut32.
dll.
VarCatoleaut32.
dll.
VarDivoleaut32.
dll.
VarEqvoleaut32.
dll.
VarIdivoleaut32.
dll.
VarImpoleaut32.
dll.
VarModoleaut32.
dll.
VarMuloleaut32.
dll.
VarOroleaut32.
dll.
VarPowoleaut32.
dll.
VarSuboleaut32.
dll.
VarXoroleaut32.
dll.
VarAbsoleaut32.
dll.
VarFixoleaut32.
dll.
VarIntoleaut32.
dll.
VarNegoleaut32.
dll.
VarNotoleaut32.
dll.
VarRoundoleaut32.
dll.
VarCmpoleaut32.
dll.
VarDecAddoleaut32.
dll.
VarDecCmpoleaut32.
dll.
VarBstrCatoleaut32.
dll.
VarCyMulI4oleaut32.
dll.
VarBstrCmpole32.
dll.
CoCreateInstanceExole32.
dll.
CLSIDFromProgIDExsxs.
dll.
SxsOleAut32MapIIDOrCLSIDToTypeLibraryuser32.
dll.
GetSystemMetricsuser32.
dll.
MonitorFromWindowuser32.
dll.
MonitorFromRectPage6REGISTRYKEYSuser32.
dll.
MonitorFromPointuser32.
dll.
EnumDisplayMonitorsuser32.
dll.
GetMonitorInfoAcryptsp.
dll.
CryptAcquireContextWcryptsp.
dll.
CryptGenRandomdwmapi.
dll.
DwmIsCompositionEnabledgdi32.
dll.
GetLayoutgdi32.
dll.
GdiRealizationInfogdi32.
dll.
FontIsLinkedadvapi32.
dll.
RegOpenKeyExWHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\WindowsErrorReporting\WMRHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodepageHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\MonitorsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\FontLink\SystemLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallbackHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9Page7READFILESHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\SegoeUIHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\191abc2025695b1cbe6577c191d55adf3662d0f1.
exeHKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable\Device\KsecDDC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datPage8NetworkBehaviorCONTACTEDIPSNETWORKPORTDISTRIBUTION16.
7%50.
0%16.
7%16.
7%3702(UDP)16.
67%5355(UDP)50%138(UDP)16.
67%137(UDP)16.
67%NameIPCountryASNASNNameTriggerProcessTypeUDPPACKETSCallTimeDuringExecution(sec)SourceIPDestIPDestPort7.
1813480854Sandbox224.
0.
0.
25253557.
199187994Sandbox224.
0.
0.
25253557.
20554494858Sandbox239.
255.
255.
25037027.
25436401367Sandbox192.
168.
56.
2551379.
86339116096Sandbox224.
0.
0.
252535513.
3003180027Sandbox192.
168.
56.
255138Page9DETAILEDFILEINFOCREATED/DROPPEDFILESFILEPATHTYPEANDHASHESC:\Users\User\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPType:CompositeDocumentFileV2Document,NosummaryinfoMD5:c3d77de3d723019d7706372c03ecd64fSHA-1:26664978545d2c4b9965d9f0e0e83630be5cb60bSHA-256:4e8d510c9910d1b78b9aa71a8edd85a92e0e402a…SHA-512:d92c8593a5f0286b47ba1faa98515433418e9ce55…Size:16.
384Kilobytes.
MATCHYARARULESMATCHRULESSTATICFILEINFOFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecFirstSeenDate:2018-01-2623:46:18.
635898(aboutayearago)NumberOfClientsSeen:5LastAnalysisDate:2018-01-2623:46:18.
635898(aboutayearago)HumanExpertAnalysisResult:Nohumanexpertanalysisverdictgiventothissampleyet.
Page10DETAILEDFILEINFOADDITIONALFILEINFORMATIONPEHeadersPage11PROPERTYVALUEMagicLiteralEnum3FileTypeEnum6DebugArtifacts[]NumberOfSections3Trid[[84.
4,u'Win32ExecutableMicrosoftVisualBasic6'],[6.
7,u'Win32DynamicLinkLibrary(generic)'],[4.
6,u'Win32Executable(generic)'],[2.
0,u'GenericWin/DOSExecutable'],[2.
0,u'DOSExecutableGeneric']]CompilationTimeStamp0x5A691C22[WedJan2423:52:022018UTC]Translation0x00000x04b0LegalCopyrightFacebookInc.
InternalNameBerdache7FileVersion1.
00CompanyNameTheUPXTeamhttp://upx.
sf.
netLegalTrademarksAVASTSoftwareCommentsIntelProductNameXamasoftProductVersion1.
00FileDescriptionSourcefire,Inc.
OriginalFilenameBerdache7.
exeEntryPoint0x4011bc(.
text)MachineTypeIntel386orlater-32BitFileSize303104Ssdeep3072:zVLrYTTY6ZSwUbp4wy4lI/JcXCNxWH+hp4lRJDOQ+4XmgvbipThWcwv9k0QvA8MU:JoTmwGp4woB7N+uQQyripTVM2Y8McSha2560139454fb4515eb810075d84857d7018cad6abd328df82afdc506f8a59fd2eb2Exifinfo[{u'EXE:FileSubtype':0,u'File:FilePermissions':u'rw-r--r--',u'SourceFile':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a/191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:OriginalFileName':u'Berdache7.
exe',u'EXE:ProductName':u'Xamasoft',u'EXE:InternalName':u'Berdache7',u'File:MIMEType':u'application/octet-stream',u'File:FileAccessDate':u'2018:01:2623:45:59+00:00',u'EXE:InitializedDataSize':28672,u'File:FileModifyDate':u'2018:01:2623:45:58+00:00',u'EXE:FileVersionNumber':u'1.
0.
0.
0',u'EXE:FileVersion':1.
0,u'File:FileSize':u'296kB',u'EXE:CharacterSet':u'Unicode',u'EXE:MachineType':u'Intel386orlater,andcompatibles',u'EXE:FileOS':u'Win32',u'EXE:LegalTrademarks':u'AVASTSoftware',u'EXE:ProductVersion':1.
0,u'EXE:ObjectFileType':u'Executableapplication',u'File:FileType':u'Win32EXE',u'EXE:CompanyName':u'TheUPXTeamhttp://upx.
sf.
net',u'File:FileName':u'191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:ImageVersion':1.
0,u'File:FileTypeExtension':u'exe',u'EXE:OSVersion':4.
0,u'EXE:PEType':u'PE32',u'EXE:TimeStamp':u'2018:01:2423:52:02+00:00',u'EXE:FileFlagsMask':u'0x0000',u'EXE:LegalCopyright':u'FacebookInc.
',u'EXE:LinkerVersion':6.
0,u'EXE:FileFlags':u'(none)',u'EXE:Subsystem':u'WindowsGUI',u'File:Directory':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a',u'EXE:FileDescription':u'Sourcefire,Inc.
',u'EXE:EntryPoint':u'0x11bc',u'EXE:SubsystemVersion':4.
0,u'EXE:CodeSize':290816,u'EXE:Comments':u'Intel',u'File:FileInodeChangeDate':u'2018:01:2623:45:59+00:00',u'EXE:UninitializedDataSize':0,u'EXE:LanguageCode':u'Neutral',u'ExifTool:ExifToolVersion':10.
1,u'EXE:ProductVersionNumber':u'1.
0.
0.
0'}]MimeTypeapplication/x-dosexecImphasha9fa280944d9180b2e5bfebfa98e4a15PESectionsPage12NAMEVIRTUALADDRESSVIRTUALSIZERAWSIZEENTROPYMD5.
text0x10000x46df80x470007.
7902237762830a720db1fa39c39fe3baa9d1891d853.
data0x480000x5c1c0x10000.
0620f0b67a91f7f74151bc5be745b7110.
rsrc0x4e0000xe660x10004.
30475677175af539bded62ffaf31f36ca3cc8805c4aPEImportsMSVBVM60.
DLL_CIcos_adj_fptan__vbaFreeVar_adj_fdiv_m64_adj_fprem1None__vbaSetSystemError__vbaHresultCheckObj_adj_fdiv_m32_adj_fdiv_m16i_adj_fdivr_m16i_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaStrCmp__vbaCyI4DllFunctionCall_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler_adj_fprem_adj_fdivr_m64__vbaFPException_CIlog__vbaErrorOverflow__vbaNew2_adj_fdiv_m32i_adj_fdivr_m32i__vbaFreeStrList_adj_fdivr_m32_adj_fdiv_rNone_CIatan__vbaI4Cy_allmul_CItan_CIexpPEResources{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':321790,u'sha256':u'99663efee2758204e3cd58f3cbeb62c92b913abdc6656987467e2ea976fbed71',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1384}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':320662,u'sha256':u'a2631dedf7188fbf5640b36941d788d3fdbbb5996244b4891eb6c7313ea2596f',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1128}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_GROUP_ICON',u'offset':320628,u'sha256':u'6369848d3ee42be4460e6f4b9c8b003e2640e7e262220182de7d8f8c64cec290',u'type':u'MSWindowsiconresource-2icons,16x16',u'size':34}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_VERSION',u'offset':319776,u'sha256':u'80ff935a732d6447380ade43d114e62bf37b8cf8f0f192f0dd21bb55a372ed07',u'type':u'data',u'size':852}CERTIFICATEVALIDATION-CertificateValidationisnotApplicablePage13SCREENSHOTSPage14
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecMALWAREValkyrieFinalVerdictDETECTIONSECTIONSeverity:HighVerdict:MalwareCLASSIFICATION49%39%29%20%10%Backdoor(5.
71%)Bot(31.
33%)Exploit(0.
00%)Pua(0.
29%)TrojanGeneric(48.
76%)TrojanDownloader(0.
76%)TrojanDropper(1.
71%)Rogue(0.
10%)Virus(0.
00%)RemoteAccessTrojan(0.
00%)Spyware(0.
00%)Rootkit(0.
00%)TrojanPasswordStealer(6.
67%)Worm(4.
67%)Ransomware(0.
00%)HIGHLEVELBEHAVIORDISTRIBUTION47.
0%35.
3%6.
4%Windows(5)Misc(7)System(117)Crypto(1)Process(8)Synchronization(5)Registry(88)FileSystem(16)Device(2)ACTIVITYOVERVIEWPacker1(100.
00%)Page1ActivityDetailsPACKERThebinarylikelycontainsencryptedorcompresseddata.
ShowsourcesPage2BehaviorGraph14:45:2214:45:2214:45:22PID2784Themaliciousfilecreatedachildprocessas191abc2025695b1cbe6577c191d55adf3662d0f1.
exe(PPID2760)14:45:22CreateProcessPage3BehaviorSummaryACCESSEDFILESREADREGISTRYKEYS\Device\KsecDDC:\Users\user\AppData\Local\Temp\191abc2025695b1cbe6577c191d55adf3662d0f1.
exe.
cfgC:\Windows\sysnative\C_932.
NLSC:\Windows\sysnative\C_949.
NLSC:\Windows\sysnative\C_950.
NLSC:\Windows\sysnative\C_936.
NLSC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15Page4RESOLVEDAPISHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enablecryptbase.
dll.
SystemFunction036uxtheme.
dll.
ThemeInitApiHookuser32.
dll.
IsProcessDPIAwareoleaut32.
dll.
OleLoadPictureExoleaut32.
dll.
DispCallFuncoleaut32.
dll.
LoadTypeLibExoleaut32.
dll.
UnRegisterTypeLiboleaut32.
dll.
CreateTypeLib2oleaut32.
dll.
VarDateFromUdateoleaut32.
dll.
VarUdateFromDateoleaut32.
dll.
GetAltMonthNamesoleaut32.
dll.
VarNumFromParseNumoleaut32.
dll.
VarParseNumFromStroleaut32.
dll.
VarDecFromR4oleaut32.
dll.
VarDecFromR8oleaut32.
dll.
VarDecFromDateoleaut32.
dll.
VarDecFromI4oleaut32.
dll.
VarDecFromCyoleaut32.
dll.
VarR4FromDecoleaut32.
dll.
GetRecordInfoFromTypeInfooleaut32.
dll.
GetRecordInfoFromGuidsoleaut32.
dll.
SafeArrayGetRecordInfooleaut32.
dll.
SafeArraySetRecordInfooleaut32.
dll.
SafeArrayGetIIDoleaut32.
dll.
SafeArraySetIIDoleaut32.
dll.
SafeArrayCopyDataoleaut32.
dll.
SafeArrayAllocDescriptorExoleaut32.
dll.
SafeArrayCreateExoleaut32.
dll.
VarFormatoleaut32.
dll.
VarFormatDateTimeoleaut32.
dll.
VarFormatNumberPage5oleaut32.
dll.
VarFormatPercentoleaut32.
dll.
VarFormatCurrencyoleaut32.
dll.
VarWeekdayNameoleaut32.
dll.
VarMonthNameoleaut32.
dll.
VarAddoleaut32.
dll.
VarAndoleaut32.
dll.
VarCatoleaut32.
dll.
VarDivoleaut32.
dll.
VarEqvoleaut32.
dll.
VarIdivoleaut32.
dll.
VarImpoleaut32.
dll.
VarModoleaut32.
dll.
VarMuloleaut32.
dll.
VarOroleaut32.
dll.
VarPowoleaut32.
dll.
VarSuboleaut32.
dll.
VarXoroleaut32.
dll.
VarAbsoleaut32.
dll.
VarFixoleaut32.
dll.
VarIntoleaut32.
dll.
VarNegoleaut32.
dll.
VarNotoleaut32.
dll.
VarRoundoleaut32.
dll.
VarCmpoleaut32.
dll.
VarDecAddoleaut32.
dll.
VarDecCmpoleaut32.
dll.
VarBstrCatoleaut32.
dll.
VarCyMulI4oleaut32.
dll.
VarBstrCmpole32.
dll.
CoCreateInstanceExole32.
dll.
CLSIDFromProgIDExsxs.
dll.
SxsOleAut32MapIIDOrCLSIDToTypeLibraryuser32.
dll.
GetSystemMetricsuser32.
dll.
MonitorFromWindowuser32.
dll.
MonitorFromRectPage6REGISTRYKEYSuser32.
dll.
MonitorFromPointuser32.
dll.
EnumDisplayMonitorsuser32.
dll.
GetMonitorInfoAcryptsp.
dll.
CryptAcquireContextWcryptsp.
dll.
CryptGenRandomdwmapi.
dll.
DwmIsCompositionEnabledgdi32.
dll.
GetLayoutgdi32.
dll.
GdiRealizationInfogdi32.
dll.
FontIsLinkedadvapi32.
dll.
RegOpenKeyExWHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\WindowsErrorReporting\WMRHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodepageHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\MonitorsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\FontLink\SystemLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallbackHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9Page7READFILESHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\SegoeUIHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\191abc2025695b1cbe6577c191d55adf3662d0f1.
exeHKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable\Device\KsecDDC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datPage8NetworkBehaviorCONTACTEDIPSNETWORKPORTDISTRIBUTION16.
7%50.
0%16.
7%16.
7%3702(UDP)16.
67%5355(UDP)50%138(UDP)16.
67%137(UDP)16.
67%NameIPCountryASNASNNameTriggerProcessTypeUDPPACKETSCallTimeDuringExecution(sec)SourceIPDestIPDestPort7.
1813480854Sandbox224.
0.
0.
25253557.
199187994Sandbox224.
0.
0.
25253557.
20554494858Sandbox239.
255.
255.
25037027.
25436401367Sandbox192.
168.
56.
2551379.
86339116096Sandbox224.
0.
0.
252535513.
3003180027Sandbox192.
168.
56.
255138Page9DETAILEDFILEINFOCREATED/DROPPEDFILESFILEPATHTYPEANDHASHESC:\Users\User\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPType:CompositeDocumentFileV2Document,NosummaryinfoMD5:c3d77de3d723019d7706372c03ecd64fSHA-1:26664978545d2c4b9965d9f0e0e83630be5cb60bSHA-256:4e8d510c9910d1b78b9aa71a8edd85a92e0e402a…SHA-512:d92c8593a5f0286b47ba1faa98515433418e9ce55…Size:16.
384Kilobytes.
MATCHYARARULESMATCHRULESSTATICFILEINFOFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecFirstSeenDate:2018-01-2623:46:18.
635898(aboutayearago)NumberOfClientsSeen:5LastAnalysisDate:2018-01-2623:46:18.
635898(aboutayearago)HumanExpertAnalysisResult:Nohumanexpertanalysisverdictgiventothissampleyet.
Page10DETAILEDFILEINFOADDITIONALFILEINFORMATIONPEHeadersPage11PROPERTYVALUEMagicLiteralEnum3FileTypeEnum6DebugArtifacts[]NumberOfSections3Trid[[84.
4,u'Win32ExecutableMicrosoftVisualBasic6'],[6.
7,u'Win32DynamicLinkLibrary(generic)'],[4.
6,u'Win32Executable(generic)'],[2.
0,u'GenericWin/DOSExecutable'],[2.
0,u'DOSExecutableGeneric']]CompilationTimeStamp0x5A691C22[WedJan2423:52:022018UTC]Translation0x00000x04b0LegalCopyrightFacebookInc.
InternalNameBerdache7FileVersion1.
00CompanyNameTheUPXTeamhttp://upx.
sf.
netLegalTrademarksAVASTSoftwareCommentsIntelProductNameXamasoftProductVersion1.
00FileDescriptionSourcefire,Inc.
OriginalFilenameBerdache7.
exeEntryPoint0x4011bc(.
text)MachineTypeIntel386orlater-32BitFileSize303104Ssdeep3072:zVLrYTTY6ZSwUbp4wy4lI/JcXCNxWH+hp4lRJDOQ+4XmgvbipThWcwv9k0QvA8MU:JoTmwGp4woB7N+uQQyripTVM2Y8McSha2560139454fb4515eb810075d84857d7018cad6abd328df82afdc506f8a59fd2eb2Exifinfo[{u'EXE:FileSubtype':0,u'File:FilePermissions':u'rw-r--r--',u'SourceFile':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a/191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:OriginalFileName':u'Berdache7.
exe',u'EXE:ProductName':u'Xamasoft',u'EXE:InternalName':u'Berdache7',u'File:MIMEType':u'application/octet-stream',u'File:FileAccessDate':u'2018:01:2623:45:59+00:00',u'EXE:InitializedDataSize':28672,u'File:FileModifyDate':u'2018:01:2623:45:58+00:00',u'EXE:FileVersionNumber':u'1.
0.
0.
0',u'EXE:FileVersion':1.
0,u'File:FileSize':u'296kB',u'EXE:CharacterSet':u'Unicode',u'EXE:MachineType':u'Intel386orlater,andcompatibles',u'EXE:FileOS':u'Win32',u'EXE:LegalTrademarks':u'AVASTSoftware',u'EXE:ProductVersion':1.
0,u'EXE:ObjectFileType':u'Executableapplication',u'File:FileType':u'Win32EXE',u'EXE:CompanyName':u'TheUPXTeamhttp://upx.
sf.
net',u'File:FileName':u'191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:ImageVersion':1.
0,u'File:FileTypeExtension':u'exe',u'EXE:OSVersion':4.
0,u'EXE:PEType':u'PE32',u'EXE:TimeStamp':u'2018:01:2423:52:02+00:00',u'EXE:FileFlagsMask':u'0x0000',u'EXE:LegalCopyright':u'FacebookInc.
',u'EXE:LinkerVersion':6.
0,u'EXE:FileFlags':u'(none)',u'EXE:Subsystem':u'WindowsGUI',u'File:Directory':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a',u'EXE:FileDescription':u'Sourcefire,Inc.
',u'EXE:EntryPoint':u'0x11bc',u'EXE:SubsystemVersion':4.
0,u'EXE:CodeSize':290816,u'EXE:Comments':u'Intel',u'File:FileInodeChangeDate':u'2018:01:2623:45:59+00:00',u'EXE:UninitializedDataSize':0,u'EXE:LanguageCode':u'Neutral',u'ExifTool:ExifToolVersion':10.
1,u'EXE:ProductVersionNumber':u'1.
0.
0.
0'}]MimeTypeapplication/x-dosexecImphasha9fa280944d9180b2e5bfebfa98e4a15PESectionsPage12NAMEVIRTUALADDRESSVIRTUALSIZERAWSIZEENTROPYMD5.
text0x10000x46df80x470007.
7902237762830a720db1fa39c39fe3baa9d1891d853.
data0x480000x5c1c0x10000.
0620f0b67a91f7f74151bc5be745b7110.
rsrc0x4e0000xe660x10004.
30475677175af539bded62ffaf31f36ca3cc8805c4aPEImportsMSVBVM60.
DLL_CIcos_adj_fptan__vbaFreeVar_adj_fdiv_m64_adj_fprem1None__vbaSetSystemError__vbaHresultCheckObj_adj_fdiv_m32_adj_fdiv_m16i_adj_fdivr_m16i_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaStrCmp__vbaCyI4DllFunctionCall_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler_adj_fprem_adj_fdivr_m64__vbaFPException_CIlog__vbaErrorOverflow__vbaNew2_adj_fdiv_m32i_adj_fdivr_m32i__vbaFreeStrList_adj_fdivr_m32_adj_fdiv_rNone_CIatan__vbaI4Cy_allmul_CItan_CIexpPEResources{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':321790,u'sha256':u'99663efee2758204e3cd58f3cbeb62c92b913abdc6656987467e2ea976fbed71',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1384}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':320662,u'sha256':u'a2631dedf7188fbf5640b36941d788d3fdbbb5996244b4891eb6c7313ea2596f',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1128}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_GROUP_ICON',u'offset':320628,u'sha256':u'6369848d3ee42be4460e6f4b9c8b003e2640e7e262220182de7d8f8c64cec290',u'type':u'MSWindowsiconresource-2icons,16x16',u'size':34}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_VERSION',u'offset':319776,u'sha256':u'80ff935a732d6447380ade43d114e62bf37b8cf8f0f192f0dd21bb55a372ed07',u'type':u'data',u'size':852}CERTIFICATEVALIDATION-CertificateValidationisnotApplicablePage13SCREENSHOTSPage14
- VarParseNumFromStrcomodo相关文档
- cmdmcomodo
- WayBillcomodo
- impactcomodo
- 丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂comodo
- 2011ArubaNetworksInc.
- Europeacomodo
阿里云秋季促销活动 轻量云服务器2G5M配置新购年60元
已经有一段时间没有分享阿里云服务商的促销活动，主要原因在于他们以前的促销都仅限新用户，而且我们大部分人都已经有过账户基本上促销活动和我们无缘。即便老用户可选新产品购买，也是比较配置较高的，所以就懒得分享。这不看到有阿里云金秋活动，有不错的促销活动可以允许产品新购。即便我们是老用户，但是比如你没有购买过他们轻量服务器，也是可以享受优惠活动的。这次轻量服务器在金秋活动中力度折扣比较大，2G5M配置年付...
IMIDC(rainbow cloud)：香港/台湾/日本/莫斯科独立服务器特价,闪购大促销,最低30usd/月起
imidc怎么样?imidc彩虹网路，rainbow cloud知名服务器提供商。自营多地区数据中心，是 Apnic RIPE Afrinic Arin 认证服务商。拥有丰富的网路资源。 在2021年 6.18 开启了输血大促销，促销区域包括 香港 台湾 日本 莫斯科 等地促销机型为 E3係，参与促销地区有 香港 日本 台湾 莫斯科 等地， 限量50台,售罄为止,先到先得。所有服务器配置 CPU ...
腾讯云爆款秒杀：1C2G5M服务器38元/年,CDN流量包6元起
农历春节将至，腾讯云开启了热门爆款云产品首单特惠秒杀活动，上海/北京/广州1核2G云服务器首年仅38元起，上架了新的首单优惠活动，每天三场秒杀，长期有效，其中轻量应用服务器2G内存5M带宽仅需年费38元起，其他产品比如CDN流量包、短信包、MySQL、直播流量包、标准存储等等产品也参与活动，腾讯云官网已注册且完成实名认证的国内站用户均可参与。活动页面：https://cloud.tencent.c...
comodo为你推荐
-
主机租赁想弄个游戏主机出租，主要就是针对在校大学生的，比如ps3、xbox之类的，不知道前景如何，请大家帮我分析下国际域名注册如何申请国际域名注册域名价格这个域名有价值吗域名注册网注册域名上哪个网站最好asp主机空间asp空间是什么网站服务器租用公司想建个网站，请问租服务器按年收费是多少钱免费网站域名申请那里 可以申请免费的 网站域名啊？？空间域名空间和域名是什么？php虚拟空间怎样修改php虚拟空间单个文件上传大小限制虚拟主机管理系统大家都用的是什么虚拟主机管理系统？分享一下