VarParseNumFromStrcomodo
comodo 时间:2021-01-12 阅读:()
SummaryFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecMALWAREValkyrieFinalVerdictDETECTIONSECTIONSeverity:HighVerdict:MalwareCLASSIFICATION49%39%29%20%10%Backdoor(5.
71%)Bot(31.
33%)Exploit(0.
00%)Pua(0.
29%)TrojanGeneric(48.
76%)TrojanDownloader(0.
76%)TrojanDropper(1.
71%)Rogue(0.
10%)Virus(0.
00%)RemoteAccessTrojan(0.
00%)Spyware(0.
00%)Rootkit(0.
00%)TrojanPasswordStealer(6.
67%)Worm(4.
67%)Ransomware(0.
00%)HIGHLEVELBEHAVIORDISTRIBUTION47.
0%35.
3%6.
4%Windows(5)Misc(7)System(117)Crypto(1)Process(8)Synchronization(5)Registry(88)FileSystem(16)Device(2)ACTIVITYOVERVIEWPacker1(100.
00%)Page1ActivityDetailsPACKERThebinarylikelycontainsencryptedorcompresseddata.
ShowsourcesPage2BehaviorGraph14:45:2214:45:2214:45:22PID2784Themaliciousfilecreatedachildprocessas191abc2025695b1cbe6577c191d55adf3662d0f1.
exe(PPID2760)14:45:22CreateProcessPage3BehaviorSummaryACCESSEDFILESREADREGISTRYKEYS\Device\KsecDDC:\Users\user\AppData\Local\Temp\191abc2025695b1cbe6577c191d55adf3662d0f1.
exe.
cfgC:\Windows\sysnative\C_932.
NLSC:\Windows\sysnative\C_949.
NLSC:\Windows\sysnative\C_950.
NLSC:\Windows\sysnative\C_936.
NLSC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15Page4RESOLVEDAPISHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enablecryptbase.
dll.
SystemFunction036uxtheme.
dll.
ThemeInitApiHookuser32.
dll.
IsProcessDPIAwareoleaut32.
dll.
OleLoadPictureExoleaut32.
dll.
DispCallFuncoleaut32.
dll.
LoadTypeLibExoleaut32.
dll.
UnRegisterTypeLiboleaut32.
dll.
CreateTypeLib2oleaut32.
dll.
VarDateFromUdateoleaut32.
dll.
VarUdateFromDateoleaut32.
dll.
GetAltMonthNamesoleaut32.
dll.
VarNumFromParseNumoleaut32.
dll.
VarParseNumFromStroleaut32.
dll.
VarDecFromR4oleaut32.
dll.
VarDecFromR8oleaut32.
dll.
VarDecFromDateoleaut32.
dll.
VarDecFromI4oleaut32.
dll.
VarDecFromCyoleaut32.
dll.
VarR4FromDecoleaut32.
dll.
GetRecordInfoFromTypeInfooleaut32.
dll.
GetRecordInfoFromGuidsoleaut32.
dll.
SafeArrayGetRecordInfooleaut32.
dll.
SafeArraySetRecordInfooleaut32.
dll.
SafeArrayGetIIDoleaut32.
dll.
SafeArraySetIIDoleaut32.
dll.
SafeArrayCopyDataoleaut32.
dll.
SafeArrayAllocDescriptorExoleaut32.
dll.
SafeArrayCreateExoleaut32.
dll.
VarFormatoleaut32.
dll.
VarFormatDateTimeoleaut32.
dll.
VarFormatNumberPage5oleaut32.
dll.
VarFormatPercentoleaut32.
dll.
VarFormatCurrencyoleaut32.
dll.
VarWeekdayNameoleaut32.
dll.
VarMonthNameoleaut32.
dll.
VarAddoleaut32.
dll.
VarAndoleaut32.
dll.
VarCatoleaut32.
dll.
VarDivoleaut32.
dll.
VarEqvoleaut32.
dll.
VarIdivoleaut32.
dll.
VarImpoleaut32.
dll.
VarModoleaut32.
dll.
VarMuloleaut32.
dll.
VarOroleaut32.
dll.
VarPowoleaut32.
dll.
VarSuboleaut32.
dll.
VarXoroleaut32.
dll.
VarAbsoleaut32.
dll.
VarFixoleaut32.
dll.
VarIntoleaut32.
dll.
VarNegoleaut32.
dll.
VarNotoleaut32.
dll.
VarRoundoleaut32.
dll.
VarCmpoleaut32.
dll.
VarDecAddoleaut32.
dll.
VarDecCmpoleaut32.
dll.
VarBstrCatoleaut32.
dll.
VarCyMulI4oleaut32.
dll.
VarBstrCmpole32.
dll.
CoCreateInstanceExole32.
dll.
CLSIDFromProgIDExsxs.
dll.
SxsOleAut32MapIIDOrCLSIDToTypeLibraryuser32.
dll.
GetSystemMetricsuser32.
dll.
MonitorFromWindowuser32.
dll.
MonitorFromRectPage6REGISTRYKEYSuser32.
dll.
MonitorFromPointuser32.
dll.
EnumDisplayMonitorsuser32.
dll.
GetMonitorInfoAcryptsp.
dll.
CryptAcquireContextWcryptsp.
dll.
CryptGenRandomdwmapi.
dll.
DwmIsCompositionEnabledgdi32.
dll.
GetLayoutgdi32.
dll.
GdiRealizationInfogdi32.
dll.
FontIsLinkedadvapi32.
dll.
RegOpenKeyExWHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\WindowsErrorReporting\WMRHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodepageHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\MonitorsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\FontLink\SystemLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallbackHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9Page7READFILESHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\SegoeUIHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\191abc2025695b1cbe6577c191d55adf3662d0f1.
exeHKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable\Device\KsecDDC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datPage8NetworkBehaviorCONTACTEDIPSNETWORKPORTDISTRIBUTION16.
7%50.
0%16.
7%16.
7%3702(UDP)16.
67%5355(UDP)50%138(UDP)16.
67%137(UDP)16.
67%NameIPCountryASNASNNameTriggerProcessTypeUDPPACKETSCallTimeDuringExecution(sec)SourceIPDestIPDestPort7.
1813480854Sandbox224.
0.
0.
25253557.
199187994Sandbox224.
0.
0.
25253557.
20554494858Sandbox239.
255.
255.
25037027.
25436401367Sandbox192.
168.
56.
2551379.
86339116096Sandbox224.
0.
0.
252535513.
3003180027Sandbox192.
168.
56.
255138Page9DETAILEDFILEINFOCREATED/DROPPEDFILESFILEPATHTYPEANDHASHESC:\Users\User\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPType:CompositeDocumentFileV2Document,NosummaryinfoMD5:c3d77de3d723019d7706372c03ecd64fSHA-1:26664978545d2c4b9965d9f0e0e83630be5cb60bSHA-256:4e8d510c9910d1b78b9aa71a8edd85a92e0e402a…SHA-512:d92c8593a5f0286b47ba1faa98515433418e9ce55…Size:16.
384Kilobytes.
MATCHYARARULESMATCHRULESSTATICFILEINFOFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecFirstSeenDate:2018-01-2623:46:18.
635898(aboutayearago)NumberOfClientsSeen:5LastAnalysisDate:2018-01-2623:46:18.
635898(aboutayearago)HumanExpertAnalysisResult:Nohumanexpertanalysisverdictgiventothissampleyet.
Page10DETAILEDFILEINFOADDITIONALFILEINFORMATIONPEHeadersPage11PROPERTYVALUEMagicLiteralEnum3FileTypeEnum6DebugArtifacts[]NumberOfSections3Trid[[84.
4,u'Win32ExecutableMicrosoftVisualBasic6'],[6.
7,u'Win32DynamicLinkLibrary(generic)'],[4.
6,u'Win32Executable(generic)'],[2.
0,u'GenericWin/DOSExecutable'],[2.
0,u'DOSExecutableGeneric']]CompilationTimeStamp0x5A691C22[WedJan2423:52:022018UTC]Translation0x00000x04b0LegalCopyrightFacebookInc.
InternalNameBerdache7FileVersion1.
00CompanyNameTheUPXTeamhttp://upx.
sf.
netLegalTrademarksAVASTSoftwareCommentsIntelProductNameXamasoftProductVersion1.
00FileDescriptionSourcefire,Inc.
OriginalFilenameBerdache7.
exeEntryPoint0x4011bc(.
text)MachineTypeIntel386orlater-32BitFileSize303104Ssdeep3072:zVLrYTTY6ZSwUbp4wy4lI/JcXCNxWH+hp4lRJDOQ+4XmgvbipThWcwv9k0QvA8MU:JoTmwGp4woB7N+uQQyripTVM2Y8McSha2560139454fb4515eb810075d84857d7018cad6abd328df82afdc506f8a59fd2eb2Exifinfo[{u'EXE:FileSubtype':0,u'File:FilePermissions':u'rw-r--r--',u'SourceFile':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a/191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:OriginalFileName':u'Berdache7.
exe',u'EXE:ProductName':u'Xamasoft',u'EXE:InternalName':u'Berdache7',u'File:MIMEType':u'application/octet-stream',u'File:FileAccessDate':u'2018:01:2623:45:59+00:00',u'EXE:InitializedDataSize':28672,u'File:FileModifyDate':u'2018:01:2623:45:58+00:00',u'EXE:FileVersionNumber':u'1.
0.
0.
0',u'EXE:FileVersion':1.
0,u'File:FileSize':u'296kB',u'EXE:CharacterSet':u'Unicode',u'EXE:MachineType':u'Intel386orlater,andcompatibles',u'EXE:FileOS':u'Win32',u'EXE:LegalTrademarks':u'AVASTSoftware',u'EXE:ProductVersion':1.
0,u'EXE:ObjectFileType':u'Executableapplication',u'File:FileType':u'Win32EXE',u'EXE:CompanyName':u'TheUPXTeamhttp://upx.
sf.
net',u'File:FileName':u'191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:ImageVersion':1.
0,u'File:FileTypeExtension':u'exe',u'EXE:OSVersion':4.
0,u'EXE:PEType':u'PE32',u'EXE:TimeStamp':u'2018:01:2423:52:02+00:00',u'EXE:FileFlagsMask':u'0x0000',u'EXE:LegalCopyright':u'FacebookInc.
',u'EXE:LinkerVersion':6.
0,u'EXE:FileFlags':u'(none)',u'EXE:Subsystem':u'WindowsGUI',u'File:Directory':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a',u'EXE:FileDescription':u'Sourcefire,Inc.
',u'EXE:EntryPoint':u'0x11bc',u'EXE:SubsystemVersion':4.
0,u'EXE:CodeSize':290816,u'EXE:Comments':u'Intel',u'File:FileInodeChangeDate':u'2018:01:2623:45:59+00:00',u'EXE:UninitializedDataSize':0,u'EXE:LanguageCode':u'Neutral',u'ExifTool:ExifToolVersion':10.
1,u'EXE:ProductVersionNumber':u'1.
0.
0.
0'}]MimeTypeapplication/x-dosexecImphasha9fa280944d9180b2e5bfebfa98e4a15PESectionsPage12NAMEVIRTUALADDRESSVIRTUALSIZERAWSIZEENTROPYMD5.
text0x10000x46df80x470007.
7902237762830a720db1fa39c39fe3baa9d1891d853.
data0x480000x5c1c0x10000.
0620f0b67a91f7f74151bc5be745b7110.
rsrc0x4e0000xe660x10004.
30475677175af539bded62ffaf31f36ca3cc8805c4aPEImportsMSVBVM60.
DLL_CIcos_adj_fptan__vbaFreeVar_adj_fdiv_m64_adj_fprem1None__vbaSetSystemError__vbaHresultCheckObj_adj_fdiv_m32_adj_fdiv_m16i_adj_fdivr_m16i_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaStrCmp__vbaCyI4DllFunctionCall_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler_adj_fprem_adj_fdivr_m64__vbaFPException_CIlog__vbaErrorOverflow__vbaNew2_adj_fdiv_m32i_adj_fdivr_m32i__vbaFreeStrList_adj_fdivr_m32_adj_fdiv_rNone_CIatan__vbaI4Cy_allmul_CItan_CIexpPEResources{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':321790,u'sha256':u'99663efee2758204e3cd58f3cbeb62c92b913abdc6656987467e2ea976fbed71',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1384}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':320662,u'sha256':u'a2631dedf7188fbf5640b36941d788d3fdbbb5996244b4891eb6c7313ea2596f',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1128}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_GROUP_ICON',u'offset':320628,u'sha256':u'6369848d3ee42be4460e6f4b9c8b003e2640e7e262220182de7d8f8c64cec290',u'type':u'MSWindowsiconresource-2icons,16x16',u'size':34}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_VERSION',u'offset':319776,u'sha256':u'80ff935a732d6447380ade43d114e62bf37b8cf8f0f192f0dd21bb55a372ed07',u'type':u'data',u'size':852}CERTIFICATEVALIDATION-CertificateValidationisnotApplicablePage13SCREENSHOTSPage14
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecMALWAREValkyrieFinalVerdictDETECTIONSECTIONSeverity:HighVerdict:MalwareCLASSIFICATION49%39%29%20%10%Backdoor(5.
71%)Bot(31.
33%)Exploit(0.
00%)Pua(0.
29%)TrojanGeneric(48.
76%)TrojanDownloader(0.
76%)TrojanDropper(1.
71%)Rogue(0.
10%)Virus(0.
00%)RemoteAccessTrojan(0.
00%)Spyware(0.
00%)Rootkit(0.
00%)TrojanPasswordStealer(6.
67%)Worm(4.
67%)Ransomware(0.
00%)HIGHLEVELBEHAVIORDISTRIBUTION47.
0%35.
3%6.
4%Windows(5)Misc(7)System(117)Crypto(1)Process(8)Synchronization(5)Registry(88)FileSystem(16)Device(2)ACTIVITYOVERVIEWPacker1(100.
00%)Page1ActivityDetailsPACKERThebinarylikelycontainsencryptedorcompresseddata.
ShowsourcesPage2BehaviorGraph14:45:2214:45:2214:45:22PID2784Themaliciousfilecreatedachildprocessas191abc2025695b1cbe6577c191d55adf3662d0f1.
exe(PPID2760)14:45:22CreateProcessPage3BehaviorSummaryACCESSEDFILESREADREGISTRYKEYS\Device\KsecDDC:\Users\user\AppData\Local\Temp\191abc2025695b1cbe6577c191d55adf3662d0f1.
exe.
cfgC:\Windows\sysnative\C_932.
NLSC:\Windows\sysnative\C_949.
NLSC:\Windows\sysnative\C_950.
NLSC:\Windows\sysnative\C_936.
NLSC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15Page4RESOLVEDAPISHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enablecryptbase.
dll.
SystemFunction036uxtheme.
dll.
ThemeInitApiHookuser32.
dll.
IsProcessDPIAwareoleaut32.
dll.
OleLoadPictureExoleaut32.
dll.
DispCallFuncoleaut32.
dll.
LoadTypeLibExoleaut32.
dll.
UnRegisterTypeLiboleaut32.
dll.
CreateTypeLib2oleaut32.
dll.
VarDateFromUdateoleaut32.
dll.
VarUdateFromDateoleaut32.
dll.
GetAltMonthNamesoleaut32.
dll.
VarNumFromParseNumoleaut32.
dll.
VarParseNumFromStroleaut32.
dll.
VarDecFromR4oleaut32.
dll.
VarDecFromR8oleaut32.
dll.
VarDecFromDateoleaut32.
dll.
VarDecFromI4oleaut32.
dll.
VarDecFromCyoleaut32.
dll.
VarR4FromDecoleaut32.
dll.
GetRecordInfoFromTypeInfooleaut32.
dll.
GetRecordInfoFromGuidsoleaut32.
dll.
SafeArrayGetRecordInfooleaut32.
dll.
SafeArraySetRecordInfooleaut32.
dll.
SafeArrayGetIIDoleaut32.
dll.
SafeArraySetIIDoleaut32.
dll.
SafeArrayCopyDataoleaut32.
dll.
SafeArrayAllocDescriptorExoleaut32.
dll.
SafeArrayCreateExoleaut32.
dll.
VarFormatoleaut32.
dll.
VarFormatDateTimeoleaut32.
dll.
VarFormatNumberPage5oleaut32.
dll.
VarFormatPercentoleaut32.
dll.
VarFormatCurrencyoleaut32.
dll.
VarWeekdayNameoleaut32.
dll.
VarMonthNameoleaut32.
dll.
VarAddoleaut32.
dll.
VarAndoleaut32.
dll.
VarCatoleaut32.
dll.
VarDivoleaut32.
dll.
VarEqvoleaut32.
dll.
VarIdivoleaut32.
dll.
VarImpoleaut32.
dll.
VarModoleaut32.
dll.
VarMuloleaut32.
dll.
VarOroleaut32.
dll.
VarPowoleaut32.
dll.
VarSuboleaut32.
dll.
VarXoroleaut32.
dll.
VarAbsoleaut32.
dll.
VarFixoleaut32.
dll.
VarIntoleaut32.
dll.
VarNegoleaut32.
dll.
VarNotoleaut32.
dll.
VarRoundoleaut32.
dll.
VarCmpoleaut32.
dll.
VarDecAddoleaut32.
dll.
VarDecCmpoleaut32.
dll.
VarBstrCatoleaut32.
dll.
VarCyMulI4oleaut32.
dll.
VarBstrCmpole32.
dll.
CoCreateInstanceExole32.
dll.
CLSIDFromProgIDExsxs.
dll.
SxsOleAut32MapIIDOrCLSIDToTypeLibraryuser32.
dll.
GetSystemMetricsuser32.
dll.
MonitorFromWindowuser32.
dll.
MonitorFromRectPage6REGISTRYKEYSuser32.
dll.
MonitorFromPointuser32.
dll.
EnumDisplayMonitorsuser32.
dll.
GetMonitorInfoAcryptsp.
dll.
CryptAcquireContextWcryptsp.
dll.
CryptGenRandomdwmapi.
dll.
DwmIsCompositionEnabledgdi32.
dll.
GetLayoutgdi32.
dll.
GdiRealizationInfogdi32.
dll.
FontIsLinkedadvapi32.
dll.
RegOpenKeyExWHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\WindowsErrorReporting\WMRHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodepageHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\MonitorsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\FontLink\SystemLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallbackHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9Page7READFILESHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\SegoeUIHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\191abc2025695b1cbe6577c191d55adf3662d0f1.
exeHKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable\Device\KsecDDC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datPage8NetworkBehaviorCONTACTEDIPSNETWORKPORTDISTRIBUTION16.
7%50.
0%16.
7%16.
7%3702(UDP)16.
67%5355(UDP)50%138(UDP)16.
67%137(UDP)16.
67%NameIPCountryASNASNNameTriggerProcessTypeUDPPACKETSCallTimeDuringExecution(sec)SourceIPDestIPDestPort7.
1813480854Sandbox224.
0.
0.
25253557.
199187994Sandbox224.
0.
0.
25253557.
20554494858Sandbox239.
255.
255.
25037027.
25436401367Sandbox192.
168.
56.
2551379.
86339116096Sandbox224.
0.
0.
252535513.
3003180027Sandbox192.
168.
56.
255138Page9DETAILEDFILEINFOCREATED/DROPPEDFILESFILEPATHTYPEANDHASHESC:\Users\User\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPType:CompositeDocumentFileV2Document,NosummaryinfoMD5:c3d77de3d723019d7706372c03ecd64fSHA-1:26664978545d2c4b9965d9f0e0e83630be5cb60bSHA-256:4e8d510c9910d1b78b9aa71a8edd85a92e0e402a…SHA-512:d92c8593a5f0286b47ba1faa98515433418e9ce55…Size:16.
384Kilobytes.
MATCHYARARULESMATCHRULESSTATICFILEINFOFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecFirstSeenDate:2018-01-2623:46:18.
635898(aboutayearago)NumberOfClientsSeen:5LastAnalysisDate:2018-01-2623:46:18.
635898(aboutayearago)HumanExpertAnalysisResult:Nohumanexpertanalysisverdictgiventothissampleyet.
Page10DETAILEDFILEINFOADDITIONALFILEINFORMATIONPEHeadersPage11PROPERTYVALUEMagicLiteralEnum3FileTypeEnum6DebugArtifacts[]NumberOfSections3Trid[[84.
4,u'Win32ExecutableMicrosoftVisualBasic6'],[6.
7,u'Win32DynamicLinkLibrary(generic)'],[4.
6,u'Win32Executable(generic)'],[2.
0,u'GenericWin/DOSExecutable'],[2.
0,u'DOSExecutableGeneric']]CompilationTimeStamp0x5A691C22[WedJan2423:52:022018UTC]Translation0x00000x04b0LegalCopyrightFacebookInc.
InternalNameBerdache7FileVersion1.
00CompanyNameTheUPXTeamhttp://upx.
sf.
netLegalTrademarksAVASTSoftwareCommentsIntelProductNameXamasoftProductVersion1.
00FileDescriptionSourcefire,Inc.
OriginalFilenameBerdache7.
exeEntryPoint0x4011bc(.
text)MachineTypeIntel386orlater-32BitFileSize303104Ssdeep3072:zVLrYTTY6ZSwUbp4wy4lI/JcXCNxWH+hp4lRJDOQ+4XmgvbipThWcwv9k0QvA8MU:JoTmwGp4woB7N+uQQyripTVM2Y8McSha2560139454fb4515eb810075d84857d7018cad6abd328df82afdc506f8a59fd2eb2Exifinfo[{u'EXE:FileSubtype':0,u'File:FilePermissions':u'rw-r--r--',u'SourceFile':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a/191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:OriginalFileName':u'Berdache7.
exe',u'EXE:ProductName':u'Xamasoft',u'EXE:InternalName':u'Berdache7',u'File:MIMEType':u'application/octet-stream',u'File:FileAccessDate':u'2018:01:2623:45:59+00:00',u'EXE:InitializedDataSize':28672,u'File:FileModifyDate':u'2018:01:2623:45:58+00:00',u'EXE:FileVersionNumber':u'1.
0.
0.
0',u'EXE:FileVersion':1.
0,u'File:FileSize':u'296kB',u'EXE:CharacterSet':u'Unicode',u'EXE:MachineType':u'Intel386orlater,andcompatibles',u'EXE:FileOS':u'Win32',u'EXE:LegalTrademarks':u'AVASTSoftware',u'EXE:ProductVersion':1.
0,u'EXE:ObjectFileType':u'Executableapplication',u'File:FileType':u'Win32EXE',u'EXE:CompanyName':u'TheUPXTeamhttp://upx.
sf.
net',u'File:FileName':u'191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:ImageVersion':1.
0,u'File:FileTypeExtension':u'exe',u'EXE:OSVersion':4.
0,u'EXE:PEType':u'PE32',u'EXE:TimeStamp':u'2018:01:2423:52:02+00:00',u'EXE:FileFlagsMask':u'0x0000',u'EXE:LegalCopyright':u'FacebookInc.
',u'EXE:LinkerVersion':6.
0,u'EXE:FileFlags':u'(none)',u'EXE:Subsystem':u'WindowsGUI',u'File:Directory':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a',u'EXE:FileDescription':u'Sourcefire,Inc.
',u'EXE:EntryPoint':u'0x11bc',u'EXE:SubsystemVersion':4.
0,u'EXE:CodeSize':290816,u'EXE:Comments':u'Intel',u'File:FileInodeChangeDate':u'2018:01:2623:45:59+00:00',u'EXE:UninitializedDataSize':0,u'EXE:LanguageCode':u'Neutral',u'ExifTool:ExifToolVersion':10.
1,u'EXE:ProductVersionNumber':u'1.
0.
0.
0'}]MimeTypeapplication/x-dosexecImphasha9fa280944d9180b2e5bfebfa98e4a15PESectionsPage12NAMEVIRTUALADDRESSVIRTUALSIZERAWSIZEENTROPYMD5.
text0x10000x46df80x470007.
7902237762830a720db1fa39c39fe3baa9d1891d853.
data0x480000x5c1c0x10000.
0620f0b67a91f7f74151bc5be745b7110.
rsrc0x4e0000xe660x10004.
30475677175af539bded62ffaf31f36ca3cc8805c4aPEImportsMSVBVM60.
DLL_CIcos_adj_fptan__vbaFreeVar_adj_fdiv_m64_adj_fprem1None__vbaSetSystemError__vbaHresultCheckObj_adj_fdiv_m32_adj_fdiv_m16i_adj_fdivr_m16i_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaStrCmp__vbaCyI4DllFunctionCall_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler_adj_fprem_adj_fdivr_m64__vbaFPException_CIlog__vbaErrorOverflow__vbaNew2_adj_fdiv_m32i_adj_fdivr_m32i__vbaFreeStrList_adj_fdivr_m32_adj_fdiv_rNone_CIatan__vbaI4Cy_allmul_CItan_CIexpPEResources{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':321790,u'sha256':u'99663efee2758204e3cd58f3cbeb62c92b913abdc6656987467e2ea976fbed71',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1384}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':320662,u'sha256':u'a2631dedf7188fbf5640b36941d788d3fdbbb5996244b4891eb6c7313ea2596f',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1128}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_GROUP_ICON',u'offset':320628,u'sha256':u'6369848d3ee42be4460e6f4b9c8b003e2640e7e262220182de7d8f8c64cec290',u'type':u'MSWindowsiconresource-2icons,16x16',u'size':34}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_VERSION',u'offset':319776,u'sha256':u'80ff935a732d6447380ade43d114e62bf37b8cf8f0f192f0dd21bb55a372ed07',u'type':u'data',u'size':852}CERTIFICATEVALIDATION-CertificateValidationisnotApplicablePage13SCREENSHOTSPage14
- VarParseNumFromStrcomodo相关文档
- cmdmcomodo
- WayBillcomodo
- impactcomodo
- 丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂comodo
- 2011ArubaNetworksInc.
- Europeacomodo
印象云七夕促销，所有机器7折销售，美国CERA低至18元/月 年付217元!
印象云，成立于2019年3月的商家，公司注册于中国香港，国人运行。目前主要从事美国CERA机房高防VPS以及香港三网CN2直连VPS和美国洛杉矶GIA三网线路服务器销售。印象云香港三网CN2机房，主要是CN2直连大陆，超低延迟！对于美国CERA机房应该不陌生，主要是做高防服务器产品的，并且此机房对中国大陆支持比较友好，印象云美国高防VPS服务器去程是163直连、三网回程CN2优化，单IP默认给20...
UCloud新人优惠中国香港/日本/美国云服务器低至4元
UCloud优刻得商家这几年应该已经被我们不少的个人站长用户认知，且确实在当下阿里云、腾讯云服务商不断的只促销服务于新用户活动，给我们很多老用户折扣的空间不多。于是，我们可以通过拓展选择其他同类服务商享受新人的福利，这里其中之一就选择UCloud商家。UCloud服务商2020年创业板上市的，实际上很早就有认识到，那时候价格高的离谱，谁让他们只服务有钱的企业用户呢。这里希望融入到我们大众消费者，你...
Digital-VM80美元新加坡和日本独立服务器
Digital-VM商家的暑期活动促销，这个商家提供有多个数据中心独立服务器、VPS主机产品。最低配置月付80美元，支持带宽、流量和IP的自定义配置。Digital-VM，是2019年新成立的商家，主要从事日本东京、新加坡、美国洛杉矶、荷兰阿姆斯特丹、西班牙马德里、挪威奥斯陆、丹麦哥本哈根数据中心的KVM架构VPS产品销售，分为大硬盘型（1Gbps带宽端口、分配较大的硬盘）和大带宽型（10Gbps...
comodo为你推荐
-
免费虚拟主机急：哪个网站提供免费的虚拟主机，谢谢。海外虚拟主机空间建个网站、买一个国外的空间或是虚拟主机、请问哪里有？vpsvps是什么？网站空间域名网站空间,域名,操作网站空间购买哪里买网站空间好？100m网站空间网站空间100M指多大山东虚拟主机400电话哪家代理商办理得比较好郑州虚拟主机什么是双线虚拟主机？北京虚拟主机虚拟主机 那个好用又实惠长沙虚拟主机长沙双线虚拟主机湖南稳定双线虚拟主机湖南双线主机租用推荐一个?