VarParseNumFromStrcomodo
comodo 时间:2021-01-12 阅读:()
SummaryFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecMALWAREValkyrieFinalVerdictDETECTIONSECTIONSeverity:HighVerdict:MalwareCLASSIFICATION49%39%29%20%10%Backdoor(5.
71%)Bot(31.
33%)Exploit(0.
00%)Pua(0.
29%)TrojanGeneric(48.
76%)TrojanDownloader(0.
76%)TrojanDropper(1.
71%)Rogue(0.
10%)Virus(0.
00%)RemoteAccessTrojan(0.
00%)Spyware(0.
00%)Rootkit(0.
00%)TrojanPasswordStealer(6.
67%)Worm(4.
67%)Ransomware(0.
00%)HIGHLEVELBEHAVIORDISTRIBUTION47.
0%35.
3%6.
4%Windows(5)Misc(7)System(117)Crypto(1)Process(8)Synchronization(5)Registry(88)FileSystem(16)Device(2)ACTIVITYOVERVIEWPacker1(100.
00%)Page1ActivityDetailsPACKERThebinarylikelycontainsencryptedorcompresseddata.
ShowsourcesPage2BehaviorGraph14:45:2214:45:2214:45:22PID2784Themaliciousfilecreatedachildprocessas191abc2025695b1cbe6577c191d55adf3662d0f1.
exe(PPID2760)14:45:22CreateProcessPage3BehaviorSummaryACCESSEDFILESREADREGISTRYKEYS\Device\KsecDDC:\Users\user\AppData\Local\Temp\191abc2025695b1cbe6577c191d55adf3662d0f1.
exe.
cfgC:\Windows\sysnative\C_932.
NLSC:\Windows\sysnative\C_949.
NLSC:\Windows\sysnative\C_950.
NLSC:\Windows\sysnative\C_936.
NLSC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15Page4RESOLVEDAPISHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enablecryptbase.
dll.
SystemFunction036uxtheme.
dll.
ThemeInitApiHookuser32.
dll.
IsProcessDPIAwareoleaut32.
dll.
OleLoadPictureExoleaut32.
dll.
DispCallFuncoleaut32.
dll.
LoadTypeLibExoleaut32.
dll.
UnRegisterTypeLiboleaut32.
dll.
CreateTypeLib2oleaut32.
dll.
VarDateFromUdateoleaut32.
dll.
VarUdateFromDateoleaut32.
dll.
GetAltMonthNamesoleaut32.
dll.
VarNumFromParseNumoleaut32.
dll.
VarParseNumFromStroleaut32.
dll.
VarDecFromR4oleaut32.
dll.
VarDecFromR8oleaut32.
dll.
VarDecFromDateoleaut32.
dll.
VarDecFromI4oleaut32.
dll.
VarDecFromCyoleaut32.
dll.
VarR4FromDecoleaut32.
dll.
GetRecordInfoFromTypeInfooleaut32.
dll.
GetRecordInfoFromGuidsoleaut32.
dll.
SafeArrayGetRecordInfooleaut32.
dll.
SafeArraySetRecordInfooleaut32.
dll.
SafeArrayGetIIDoleaut32.
dll.
SafeArraySetIIDoleaut32.
dll.
SafeArrayCopyDataoleaut32.
dll.
SafeArrayAllocDescriptorExoleaut32.
dll.
SafeArrayCreateExoleaut32.
dll.
VarFormatoleaut32.
dll.
VarFormatDateTimeoleaut32.
dll.
VarFormatNumberPage5oleaut32.
dll.
VarFormatPercentoleaut32.
dll.
VarFormatCurrencyoleaut32.
dll.
VarWeekdayNameoleaut32.
dll.
VarMonthNameoleaut32.
dll.
VarAddoleaut32.
dll.
VarAndoleaut32.
dll.
VarCatoleaut32.
dll.
VarDivoleaut32.
dll.
VarEqvoleaut32.
dll.
VarIdivoleaut32.
dll.
VarImpoleaut32.
dll.
VarModoleaut32.
dll.
VarMuloleaut32.
dll.
VarOroleaut32.
dll.
VarPowoleaut32.
dll.
VarSuboleaut32.
dll.
VarXoroleaut32.
dll.
VarAbsoleaut32.
dll.
VarFixoleaut32.
dll.
VarIntoleaut32.
dll.
VarNegoleaut32.
dll.
VarNotoleaut32.
dll.
VarRoundoleaut32.
dll.
VarCmpoleaut32.
dll.
VarDecAddoleaut32.
dll.
VarDecCmpoleaut32.
dll.
VarBstrCatoleaut32.
dll.
VarCyMulI4oleaut32.
dll.
VarBstrCmpole32.
dll.
CoCreateInstanceExole32.
dll.
CLSIDFromProgIDExsxs.
dll.
SxsOleAut32MapIIDOrCLSIDToTypeLibraryuser32.
dll.
GetSystemMetricsuser32.
dll.
MonitorFromWindowuser32.
dll.
MonitorFromRectPage6REGISTRYKEYSuser32.
dll.
MonitorFromPointuser32.
dll.
EnumDisplayMonitorsuser32.
dll.
GetMonitorInfoAcryptsp.
dll.
CryptAcquireContextWcryptsp.
dll.
CryptGenRandomdwmapi.
dll.
DwmIsCompositionEnabledgdi32.
dll.
GetLayoutgdi32.
dll.
GdiRealizationInfogdi32.
dll.
FontIsLinkedadvapi32.
dll.
RegOpenKeyExWHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\WindowsErrorReporting\WMRHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodepageHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\MonitorsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\FontLink\SystemLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallbackHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9Page7READFILESHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\SegoeUIHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\191abc2025695b1cbe6577c191d55adf3662d0f1.
exeHKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable\Device\KsecDDC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datPage8NetworkBehaviorCONTACTEDIPSNETWORKPORTDISTRIBUTION16.
7%50.
0%16.
7%16.
7%3702(UDP)16.
67%5355(UDP)50%138(UDP)16.
67%137(UDP)16.
67%NameIPCountryASNASNNameTriggerProcessTypeUDPPACKETSCallTimeDuringExecution(sec)SourceIPDestIPDestPort7.
1813480854Sandbox224.
0.
0.
25253557.
199187994Sandbox224.
0.
0.
25253557.
20554494858Sandbox239.
255.
255.
25037027.
25436401367Sandbox192.
168.
56.
2551379.
86339116096Sandbox224.
0.
0.
252535513.
3003180027Sandbox192.
168.
56.
255138Page9DETAILEDFILEINFOCREATED/DROPPEDFILESFILEPATHTYPEANDHASHESC:\Users\User\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPType:CompositeDocumentFileV2Document,NosummaryinfoMD5:c3d77de3d723019d7706372c03ecd64fSHA-1:26664978545d2c4b9965d9f0e0e83630be5cb60bSHA-256:4e8d510c9910d1b78b9aa71a8edd85a92e0e402a…SHA-512:d92c8593a5f0286b47ba1faa98515433418e9ce55…Size:16.
384Kilobytes.
MATCHYARARULESMATCHRULESSTATICFILEINFOFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecFirstSeenDate:2018-01-2623:46:18.
635898(aboutayearago)NumberOfClientsSeen:5LastAnalysisDate:2018-01-2623:46:18.
635898(aboutayearago)HumanExpertAnalysisResult:Nohumanexpertanalysisverdictgiventothissampleyet.
Page10DETAILEDFILEINFOADDITIONALFILEINFORMATIONPEHeadersPage11PROPERTYVALUEMagicLiteralEnum3FileTypeEnum6DebugArtifacts[]NumberOfSections3Trid[[84.
4,u'Win32ExecutableMicrosoftVisualBasic6'],[6.
7,u'Win32DynamicLinkLibrary(generic)'],[4.
6,u'Win32Executable(generic)'],[2.
0,u'GenericWin/DOSExecutable'],[2.
0,u'DOSExecutableGeneric']]CompilationTimeStamp0x5A691C22[WedJan2423:52:022018UTC]Translation0x00000x04b0LegalCopyrightFacebookInc.
InternalNameBerdache7FileVersion1.
00CompanyNameTheUPXTeamhttp://upx.
sf.
netLegalTrademarksAVASTSoftwareCommentsIntelProductNameXamasoftProductVersion1.
00FileDescriptionSourcefire,Inc.
OriginalFilenameBerdache7.
exeEntryPoint0x4011bc(.
text)MachineTypeIntel386orlater-32BitFileSize303104Ssdeep3072:zVLrYTTY6ZSwUbp4wy4lI/JcXCNxWH+hp4lRJDOQ+4XmgvbipThWcwv9k0QvA8MU:JoTmwGp4woB7N+uQQyripTVM2Y8McSha2560139454fb4515eb810075d84857d7018cad6abd328df82afdc506f8a59fd2eb2Exifinfo[{u'EXE:FileSubtype':0,u'File:FilePermissions':u'rw-r--r--',u'SourceFile':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a/191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:OriginalFileName':u'Berdache7.
exe',u'EXE:ProductName':u'Xamasoft',u'EXE:InternalName':u'Berdache7',u'File:MIMEType':u'application/octet-stream',u'File:FileAccessDate':u'2018:01:2623:45:59+00:00',u'EXE:InitializedDataSize':28672,u'File:FileModifyDate':u'2018:01:2623:45:58+00:00',u'EXE:FileVersionNumber':u'1.
0.
0.
0',u'EXE:FileVersion':1.
0,u'File:FileSize':u'296kB',u'EXE:CharacterSet':u'Unicode',u'EXE:MachineType':u'Intel386orlater,andcompatibles',u'EXE:FileOS':u'Win32',u'EXE:LegalTrademarks':u'AVASTSoftware',u'EXE:ProductVersion':1.
0,u'EXE:ObjectFileType':u'Executableapplication',u'File:FileType':u'Win32EXE',u'EXE:CompanyName':u'TheUPXTeamhttp://upx.
sf.
net',u'File:FileName':u'191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:ImageVersion':1.
0,u'File:FileTypeExtension':u'exe',u'EXE:OSVersion':4.
0,u'EXE:PEType':u'PE32',u'EXE:TimeStamp':u'2018:01:2423:52:02+00:00',u'EXE:FileFlagsMask':u'0x0000',u'EXE:LegalCopyright':u'FacebookInc.
',u'EXE:LinkerVersion':6.
0,u'EXE:FileFlags':u'(none)',u'EXE:Subsystem':u'WindowsGUI',u'File:Directory':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a',u'EXE:FileDescription':u'Sourcefire,Inc.
',u'EXE:EntryPoint':u'0x11bc',u'EXE:SubsystemVersion':4.
0,u'EXE:CodeSize':290816,u'EXE:Comments':u'Intel',u'File:FileInodeChangeDate':u'2018:01:2623:45:59+00:00',u'EXE:UninitializedDataSize':0,u'EXE:LanguageCode':u'Neutral',u'ExifTool:ExifToolVersion':10.
1,u'EXE:ProductVersionNumber':u'1.
0.
0.
0'}]MimeTypeapplication/x-dosexecImphasha9fa280944d9180b2e5bfebfa98e4a15PESectionsPage12NAMEVIRTUALADDRESSVIRTUALSIZERAWSIZEENTROPYMD5.
text0x10000x46df80x470007.
7902237762830a720db1fa39c39fe3baa9d1891d853.
data0x480000x5c1c0x10000.
0620f0b67a91f7f74151bc5be745b7110.
rsrc0x4e0000xe660x10004.
30475677175af539bded62ffaf31f36ca3cc8805c4aPEImportsMSVBVM60.
DLL_CIcos_adj_fptan__vbaFreeVar_adj_fdiv_m64_adj_fprem1None__vbaSetSystemError__vbaHresultCheckObj_adj_fdiv_m32_adj_fdiv_m16i_adj_fdivr_m16i_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaStrCmp__vbaCyI4DllFunctionCall_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler_adj_fprem_adj_fdivr_m64__vbaFPException_CIlog__vbaErrorOverflow__vbaNew2_adj_fdiv_m32i_adj_fdivr_m32i__vbaFreeStrList_adj_fdivr_m32_adj_fdiv_rNone_CIatan__vbaI4Cy_allmul_CItan_CIexpPEResources{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':321790,u'sha256':u'99663efee2758204e3cd58f3cbeb62c92b913abdc6656987467e2ea976fbed71',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1384}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':320662,u'sha256':u'a2631dedf7188fbf5640b36941d788d3fdbbb5996244b4891eb6c7313ea2596f',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1128}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_GROUP_ICON',u'offset':320628,u'sha256':u'6369848d3ee42be4460e6f4b9c8b003e2640e7e262220182de7d8f8c64cec290',u'type':u'MSWindowsiconresource-2icons,16x16',u'size':34}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_VERSION',u'offset':319776,u'sha256':u'80ff935a732d6447380ade43d114e62bf37b8cf8f0f192f0dd21bb55a372ed07',u'type':u'data',u'size':852}CERTIFICATEVALIDATION-CertificateValidationisnotApplicablePage13SCREENSHOTSPage14
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecMALWAREValkyrieFinalVerdictDETECTIONSECTIONSeverity:HighVerdict:MalwareCLASSIFICATION49%39%29%20%10%Backdoor(5.
71%)Bot(31.
33%)Exploit(0.
00%)Pua(0.
29%)TrojanGeneric(48.
76%)TrojanDownloader(0.
76%)TrojanDropper(1.
71%)Rogue(0.
10%)Virus(0.
00%)RemoteAccessTrojan(0.
00%)Spyware(0.
00%)Rootkit(0.
00%)TrojanPasswordStealer(6.
67%)Worm(4.
67%)Ransomware(0.
00%)HIGHLEVELBEHAVIORDISTRIBUTION47.
0%35.
3%6.
4%Windows(5)Misc(7)System(117)Crypto(1)Process(8)Synchronization(5)Registry(88)FileSystem(16)Device(2)ACTIVITYOVERVIEWPacker1(100.
00%)Page1ActivityDetailsPACKERThebinarylikelycontainsencryptedorcompresseddata.
ShowsourcesPage2BehaviorGraph14:45:2214:45:2214:45:22PID2784Themaliciousfilecreatedachildprocessas191abc2025695b1cbe6577c191d55adf3662d0f1.
exe(PPID2760)14:45:22CreateProcessPage3BehaviorSummaryACCESSEDFILESREADREGISTRYKEYS\Device\KsecDDC:\Users\user\AppData\Local\Temp\191abc2025695b1cbe6577c191d55adf3662d0f1.
exe.
cfgC:\Windows\sysnative\C_932.
NLSC:\Windows\sysnative\C_949.
NLSC:\Windows\sysnative\C_950.
NLSC:\Windows\sysnative\C_936.
NLSC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15Page4RESOLVEDAPISHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enablecryptbase.
dll.
SystemFunction036uxtheme.
dll.
ThemeInitApiHookuser32.
dll.
IsProcessDPIAwareoleaut32.
dll.
OleLoadPictureExoleaut32.
dll.
DispCallFuncoleaut32.
dll.
LoadTypeLibExoleaut32.
dll.
UnRegisterTypeLiboleaut32.
dll.
CreateTypeLib2oleaut32.
dll.
VarDateFromUdateoleaut32.
dll.
VarUdateFromDateoleaut32.
dll.
GetAltMonthNamesoleaut32.
dll.
VarNumFromParseNumoleaut32.
dll.
VarParseNumFromStroleaut32.
dll.
VarDecFromR4oleaut32.
dll.
VarDecFromR8oleaut32.
dll.
VarDecFromDateoleaut32.
dll.
VarDecFromI4oleaut32.
dll.
VarDecFromCyoleaut32.
dll.
VarR4FromDecoleaut32.
dll.
GetRecordInfoFromTypeInfooleaut32.
dll.
GetRecordInfoFromGuidsoleaut32.
dll.
SafeArrayGetRecordInfooleaut32.
dll.
SafeArraySetRecordInfooleaut32.
dll.
SafeArrayGetIIDoleaut32.
dll.
SafeArraySetIIDoleaut32.
dll.
SafeArrayCopyDataoleaut32.
dll.
SafeArrayAllocDescriptorExoleaut32.
dll.
SafeArrayCreateExoleaut32.
dll.
VarFormatoleaut32.
dll.
VarFormatDateTimeoleaut32.
dll.
VarFormatNumberPage5oleaut32.
dll.
VarFormatPercentoleaut32.
dll.
VarFormatCurrencyoleaut32.
dll.
VarWeekdayNameoleaut32.
dll.
VarMonthNameoleaut32.
dll.
VarAddoleaut32.
dll.
VarAndoleaut32.
dll.
VarCatoleaut32.
dll.
VarDivoleaut32.
dll.
VarEqvoleaut32.
dll.
VarIdivoleaut32.
dll.
VarImpoleaut32.
dll.
VarModoleaut32.
dll.
VarMuloleaut32.
dll.
VarOroleaut32.
dll.
VarPowoleaut32.
dll.
VarSuboleaut32.
dll.
VarXoroleaut32.
dll.
VarAbsoleaut32.
dll.
VarFixoleaut32.
dll.
VarIntoleaut32.
dll.
VarNegoleaut32.
dll.
VarNotoleaut32.
dll.
VarRoundoleaut32.
dll.
VarCmpoleaut32.
dll.
VarDecAddoleaut32.
dll.
VarDecCmpoleaut32.
dll.
VarBstrCatoleaut32.
dll.
VarCyMulI4oleaut32.
dll.
VarBstrCmpole32.
dll.
CoCreateInstanceExole32.
dll.
CLSIDFromProgIDExsxs.
dll.
SxsOleAut32MapIIDOrCLSIDToTypeLibraryuser32.
dll.
GetSystemMetricsuser32.
dll.
MonitorFromWindowuser32.
dll.
MonitorFromRectPage6REGISTRYKEYSuser32.
dll.
MonitorFromPointuser32.
dll.
EnumDisplayMonitorsuser32.
dll.
GetMonitorInfoAcryptsp.
dll.
CryptAcquireContextWcryptsp.
dll.
CryptGenRandomdwmapi.
dll.
DwmIsCompositionEnabledgdi32.
dll.
GetLayoutgdi32.
dll.
GdiRealizationInfogdi32.
dll.
FontIsLinkedadvapi32.
dll.
RegOpenKeyExWHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\WindowsErrorReporting\WMRHKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\WindowsErrorReporting\WMR\DisableHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSIONMANAGER\SafeProcessSearchModeHKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CodepageHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\MonitorsHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\FontLink\SystemLinkHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DisableHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\DataStore_V1.
0\DataFilePathHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallbackHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9Page7READFILESHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\LanguagePack\SurrogateFallback\SegoeUIHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\191abc2025695b1cbe6577c191d55adf3662d0f1.
exeHKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable\Device\KsecDDC:\Users\user\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPC:\Windows\Fonts\staticcache.
datPage8NetworkBehaviorCONTACTEDIPSNETWORKPORTDISTRIBUTION16.
7%50.
0%16.
7%16.
7%3702(UDP)16.
67%5355(UDP)50%138(UDP)16.
67%137(UDP)16.
67%NameIPCountryASNASNNameTriggerProcessTypeUDPPACKETSCallTimeDuringExecution(sec)SourceIPDestIPDestPort7.
1813480854Sandbox224.
0.
0.
25253557.
199187994Sandbox224.
0.
0.
25253557.
20554494858Sandbox239.
255.
255.
25037027.
25436401367Sandbox192.
168.
56.
2551379.
86339116096Sandbox224.
0.
0.
252535513.
3003180027Sandbox192.
168.
56.
255138Page9DETAILEDFILEINFOCREATED/DROPPEDFILESFILEPATHTYPEANDHASHESC:\Users\User\AppData\Local\Temp\~DF6F7E0B183ED933BA.
TMPType:CompositeDocumentFileV2Document,NosummaryinfoMD5:c3d77de3d723019d7706372c03ecd64fSHA-1:26664978545d2c4b9965d9f0e0e83630be5cb60bSHA-256:4e8d510c9910d1b78b9aa71a8edd85a92e0e402a…SHA-512:d92c8593a5f0286b47ba1faa98515433418e9ce55…Size:16.
384Kilobytes.
MATCHYARARULESMATCHRULESSTATICFILEINFOFileName:putty.
exeFileType:PE32executable(GUI)Intel80386,forMSWindowsSHA1:191abc2025695b1cbe6577c191d55adf3662d0f1MD5:d15600df4207ff41fb1f5a44063917ecFirstSeenDate:2018-01-2623:46:18.
635898(aboutayearago)NumberOfClientsSeen:5LastAnalysisDate:2018-01-2623:46:18.
635898(aboutayearago)HumanExpertAnalysisResult:Nohumanexpertanalysisverdictgiventothissampleyet.
Page10DETAILEDFILEINFOADDITIONALFILEINFORMATIONPEHeadersPage11PROPERTYVALUEMagicLiteralEnum3FileTypeEnum6DebugArtifacts[]NumberOfSections3Trid[[84.
4,u'Win32ExecutableMicrosoftVisualBasic6'],[6.
7,u'Win32DynamicLinkLibrary(generic)'],[4.
6,u'Win32Executable(generic)'],[2.
0,u'GenericWin/DOSExecutable'],[2.
0,u'DOSExecutableGeneric']]CompilationTimeStamp0x5A691C22[WedJan2423:52:022018UTC]Translation0x00000x04b0LegalCopyrightFacebookInc.
InternalNameBerdache7FileVersion1.
00CompanyNameTheUPXTeamhttp://upx.
sf.
netLegalTrademarksAVASTSoftwareCommentsIntelProductNameXamasoftProductVersion1.
00FileDescriptionSourcefire,Inc.
OriginalFilenameBerdache7.
exeEntryPoint0x4011bc(.
text)MachineTypeIntel386orlater-32BitFileSize303104Ssdeep3072:zVLrYTTY6ZSwUbp4wy4lI/JcXCNxWH+hp4lRJDOQ+4XmgvbipThWcwv9k0QvA8MU:JoTmwGp4woB7N+uQQyripTVM2Y8McSha2560139454fb4515eb810075d84857d7018cad6abd328df82afdc506f8a59fd2eb2Exifinfo[{u'EXE:FileSubtype':0,u'File:FilePermissions':u'rw-r--r--',u'SourceFile':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a/191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:OriginalFileName':u'Berdache7.
exe',u'EXE:ProductName':u'Xamasoft',u'EXE:InternalName':u'Berdache7',u'File:MIMEType':u'application/octet-stream',u'File:FileAccessDate':u'2018:01:2623:45:59+00:00',u'EXE:InitializedDataSize':28672,u'File:FileModifyDate':u'2018:01:2623:45:58+00:00',u'EXE:FileVersionNumber':u'1.
0.
0.
0',u'EXE:FileVersion':1.
0,u'File:FileSize':u'296kB',u'EXE:CharacterSet':u'Unicode',u'EXE:MachineType':u'Intel386orlater,andcompatibles',u'EXE:FileOS':u'Win32',u'EXE:LegalTrademarks':u'AVASTSoftware',u'EXE:ProductVersion':1.
0,u'EXE:ObjectFileType':u'Executableapplication',u'File:FileType':u'Win32EXE',u'EXE:CompanyName':u'TheUPXTeamhttp://upx.
sf.
net',u'File:FileName':u'191abc2025695b1cbe6577c191d55adf3662d0f1',u'EXE:ImageVersion':1.
0,u'File:FileTypeExtension':u'exe',u'EXE:OSVersion':4.
0,u'EXE:PEType':u'PE32',u'EXE:TimeStamp':u'2018:01:2423:52:02+00:00',u'EXE:FileFlagsMask':u'0x0000',u'EXE:LegalCopyright':u'FacebookInc.
',u'EXE:LinkerVersion':6.
0,u'EXE:FileFlags':u'(none)',u'EXE:Subsystem':u'WindowsGUI',u'File:Directory':u'/nfs/fvs/valkyrie_shared/core/valkyrie_files/1/9/1/a',u'EXE:FileDescription':u'Sourcefire,Inc.
',u'EXE:EntryPoint':u'0x11bc',u'EXE:SubsystemVersion':4.
0,u'EXE:CodeSize':290816,u'EXE:Comments':u'Intel',u'File:FileInodeChangeDate':u'2018:01:2623:45:59+00:00',u'EXE:UninitializedDataSize':0,u'EXE:LanguageCode':u'Neutral',u'ExifTool:ExifToolVersion':10.
1,u'EXE:ProductVersionNumber':u'1.
0.
0.
0'}]MimeTypeapplication/x-dosexecImphasha9fa280944d9180b2e5bfebfa98e4a15PESectionsPage12NAMEVIRTUALADDRESSVIRTUALSIZERAWSIZEENTROPYMD5.
text0x10000x46df80x470007.
7902237762830a720db1fa39c39fe3baa9d1891d853.
data0x480000x5c1c0x10000.
0620f0b67a91f7f74151bc5be745b7110.
rsrc0x4e0000xe660x10004.
30475677175af539bded62ffaf31f36ca3cc8805c4aPEImportsMSVBVM60.
DLL_CIcos_adj_fptan__vbaFreeVar_adj_fdiv_m64_adj_fprem1None__vbaSetSystemError__vbaHresultCheckObj_adj_fdiv_m32_adj_fdiv_m16i_adj_fdivr_m16i_CIsin__vbaChkstkEVENT_SINK_AddRef__vbaStrCmp__vbaCyI4DllFunctionCall_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler_adj_fprem_adj_fdivr_m64__vbaFPException_CIlog__vbaErrorOverflow__vbaNew2_adj_fdiv_m32i_adj_fdivr_m32i__vbaFreeStrList_adj_fdivr_m32_adj_fdiv_rNone_CIatan__vbaI4Cy_allmul_CItan_CIexpPEResources{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':321790,u'sha256':u'99663efee2758204e3cd58f3cbeb62c92b913abdc6656987467e2ea976fbed71',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1384}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_ICON',u'offset':320662,u'sha256':u'a2631dedf7188fbf5640b36941d788d3fdbbb5996244b4891eb6c7313ea2596f',u'type':u'GLS_BINARY_LSB_FIRST',u'size':1128}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_GROUP_ICON',u'offset':320628,u'sha256':u'6369848d3ee42be4460e6f4b9c8b003e2640e7e262220182de7d8f8c64cec290',u'type':u'MSWindowsiconresource-2icons,16x16',u'size':34}{u'lang':u'LANG_NEUTRAL',u'name':u'RT_VERSION',u'offset':319776,u'sha256':u'80ff935a732d6447380ade43d114e62bf37b8cf8f0f192f0dd21bb55a372ed07',u'type':u'data',u'size':852}CERTIFICATEVALIDATION-CertificateValidationisnotApplicablePage13SCREENSHOTSPage14
- VarParseNumFromStrcomodo相关文档
- cmdmcomodo
- WayBillcomodo
- impactcomodo
- 丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂丂comodo
- 2011ArubaNetworksInc.
- Europeacomodo
[黑五]ProfitServer新加坡/德国/荷兰/西班牙VPS五折,不限流量KVM月付2.88美元起
ProfitServer已开启了黑色星期五的促销活动，一直到本月底，商家新加坡、荷兰、德国和西班牙机房VPS直接5折，无码直购最低每月2.88美元起，不限制流量，提供IPv4+IPv6。这是一家始于2003年的俄罗斯主机商，提供虚拟主机、VPS、独立服务器、SSL证书、域名等产品，可选数据中心包括俄罗斯、法国、荷兰、美国、新加坡、拉脱维亚、捷克、保加利亚等多个国家和地区。我们随便以一个数据中心为例...
Atcloud：全场8折优惠,美国/加拿大/英国/法国/德国/新加坡vps,500g大硬盘/2T流量/480G高防vps,$4/月
atcloud怎么样?atcloud刚刚发布了最新的8折优惠码，该商家主要提供常规cloud(VPS)和storage(大硬盘存储)系列VPS，其数据中心分布在美国(俄勒冈、弗吉尼亚)、加拿大、英国、法国、德国、新加坡，所有VPS默认提供480Gbps的超高DDoS防御。Atcloud高防VPS。atcloud.net，2020年成立，主要提供基于KVM虚拟架构的VPS、只能DNS解析、域名、SS...
10gbiz首月半价月付2.36美元，香港/洛杉矶VPS、硅谷独立服务器/站群服务器
收到10gbiz发来的7月份优惠方案，中国香港、美国洛杉矶机房VPS主机4折优惠码，优惠后洛杉矶VPS月付2.36美元起，香港VPS月付2.75美元起。这是一家2020年成立的主机商，提供的产品包括独立服务器租用和VPS主机等，数据中心在美国洛杉矶、圣何塞和中国香港。商家VPS主机基于KVM架构，支持使用PayPal或者支付宝付款。洛杉矶VPS架构CPU内存硬盘带宽系统价格单核512MB10GB1...
comodo为你推荐
-
网络域名注册怎么才能申请一个网站？申请到域名以后需要怎么做？域名空间代理域名空间服务商哪个好啊？找了一天都没确定哪个好？海外主机美国主机哪个好，最好是速度和稳定性能跟得上？个人虚拟主机个人网站该购买什么类型虚拟主机？香港虚拟空间最好的香港虚拟主机是哪家？免备案虚拟空间虚拟免费空间网站怎么备案网站空间购买国内网站空间购买哪里的比较实惠啊？网站空间免备案哪有不用备案的网站空间？网站空间免备案哪个网站有免费的免备案空间，海外港台都可上海虚拟主机上海哪个域名注册和虚拟主机IDC稳定可靠，价格合适？