Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | July 2, 2021, 4:53 p.m. | July 2, 2021, 4:55 p.m. |
-
setup_dmysqd02.exe "C:\Users\test22\AppData\Local\Temp\setup_dmysqd02.exe"
1108 -
explorer.exe C:\Windows\Explorer.EXE
1848
Name | Response | Post-Analysis Lookup |
---|---|---|
ip.taobao.com | 203.119.144.58 | |
softlog.xiaota.com | 123.206.5.93 | |
i.doumaibiji.cn | 123.206.5.93 |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
section | .itext |
suspicious_features | HTTP version 1.0 used | suspicious_request | GET http://ip.taobao.com/service/getIpInfo.php?ip=myip | ||||||
suspicious_features | HTTP version 1.0 used | suspicious_request | GET http://i.doumaibiji.cn/note/read.php/t_slt/d_2018052111/mid_94DE278C3274/n_doumainote/c_dmysqd02.gif | ||||||
suspicious_features | POST method with no referer header, HTTP version 1.0 used | suspicious_request | POST http://softlog.xiaota.com/api/pushdata |
request | GET http://ip.taobao.com/service/getIpInfo.php?ip=myip |
request | GET http://i.doumaibiji.cn/note/read.php/t_slt/d_2018052111/mid_94DE278C3274/n_doumainote/c_dmysqd02.gif |
request | POST http://softlog.xiaota.com/api/pushdata |
request | POST http://softlog.xiaota.com/api/pushdata |
regkey | .*360Safe |
regkey | .*Kingsoft |
file | C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\Ksicfg.dll |
file | C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\WListViewEx.dll |
file | C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\ksicall.dll |
file | C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\webctrl.dll |
file | C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\beepdl.dll |
file | C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\beepdl.dll |
file | C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\WListViewEx.dll |
file | C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\Ksicfg.dll |
file | C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\ksicall.dll |
file | C:\Users\test22\AppData\Local\Temp\is-FC7KQ.tmp\webctrl.dll |
dead_host | 192.168.56.101:49226 |
Bkav | W32.AIDetectVM.malware1 |
Elastic | malicious (high confidence) |
DrWeb | Adware.WDJiange.54 |
FireEye | Generic.mg.45149d3d37ac7489 |
McAfee | Artemis!45149D3D37AC |
Cylance | Unsafe |
Sangfor | Malware |
K7AntiVirus | Unwanted-Program ( 00516a1d1 ) |
Alibaba | Packed:Win32/INNOmod.a8ac1559 |
K7GW | Unwanted-Program ( 00516a1d1 ) |
CrowdStrike | win/malicious_confidence_80% (D) |
Cyren | W32/Delf_Troj.W.gen!Eldorado |
Symantec | ML.Attribute.HighConfidence |
APEX | Malicious |
Kaspersky | not-a-virus:HEUR:Downloader.Win32.Generic |
NANO-Antivirus | Trojan.Win32.WDJiange.fcskqj |
Comodo | ApplicUnwnt@#1ct7xhftgq1uw |
F-Secure | Heuristic.HEUR/AGEN.1108449 |
McAfee-GW-Edition | Artemis!Trojan |
Sophos | Generic PUA BK (PUA) |
Ikarus | PUA.INNOmod |
Jiangmin | Downloader.Generic0.a |
Webroot | W32.Adware.Gen |
Avira | HEUR/AGEN.1108449 |
MAX | malware (ai score=51) |
Antiy-AVL | RiskWare[Downloader]/Win32.AGeneric |
Gridinsoft | Adware.Gen.dd!c |
Microsoft | PUA:Win32/GameBox |
ZoneAlarm | not-a-virus:HEUR:Downloader.Win32.Generic |
Cynet | Malicious (score: 100) |
VBA32 | BScope.Adware.WDJiange |
ESET-NOD32 | a variant of Win32/Packed.INNOmod.D suspicious |
Rising | Adware.Agent!1.BA30 (CLASSIC) |
Yandex | PUA.Downloader!UyQXNcPJHsY |
SentinelOne | Static AI - Suspicious PE |
eGambit | Unsafe.AI_Score_99% |
Fortinet | W32/Injector.EGXE!tr |
AVG | FileRepMalware [PUP] |
Cybereason | malicious.f4a0a5 |
Panda | Trj/Genetic.gen |