Hacktool.RobloxHack.WDA
Hacktool.RobloxHack.WDA是一个检测名称，用于识别一款面向 Roblox 玩家销售的黑客工具，该工具声称可以帮助玩家在游戏中获得不公平的优势，例如作弊、自动瞄准、利用漏洞或其他形式的游戏操控。这类软件并非游戏修改工具，而是被标记为恶意软件，因为它使用了通常与恶意软件相关的技术，包括进程内存操控、注入以及其他可能损害计算机安全性和稳定性的方法。
目录
威胁会造成什么影响？
Hacktool.RobloxHack.WDA 分类下的程序旨在干扰 Roblox 游戏客户端的正常运行。根据观察到的行为，此类工具通常会读写其他运行进程的内存、使用底层 Windows 系统调用，并试图拦截键盘输入或窗口消息。这些功能使工具能够修改游戏数值、自动执行操作或绕过反作弊保护。
该工具还被发现使用标准的Windows网络组件连接到互联网，这可能被用于下载其他文件、接收配置数据或与远程服务器通信。它还会收集计算机的基本信息，例如用户名、计算机名和网络适配器详细信息，这对于此类实用程序来说是典型的行为，但也可能被滥用以识别或追踪系统。
值得注意的是，该黑客工具包含反调试检查，这意味着它会主动尝试检测自己是否正在被分析或监控，这种特性通常与恶意软件而非合法应用程序相关。
它通常是如何进入电脑的
这类作弊工具通常是用户为了在 Roblox 中作弊而自愿下载的，下载渠道往往是非官方论坛、文件共享网站、视频描述或第三方下载门户。据观察，这类工具的安装使用了基于 Inno Setup 的安装程序，这是一种常见的 Windows 应用程序打包格式，会在安装完成前提取临时文件。由于这些工具并非通过官方或认证渠道分发，因此无法保证其真实性和安全性。
用户面临的风险
尽管此类作弊工具的危险等级被认为较低，但使用它们仍然存在实际风险。使用作弊工具的游戏账号可能会被封禁或永久停用。此外，由于此类工具会操控进程内存并通过网络进行通信，因此存在恶意或被入侵的版本可能被用于传播有害程序、记录键盘输入或窃取系统信息的风险。由于这些文件通常未经签名或使用不受信任的证书，用户很难确定软件除了其宣称的功能之外还会进行哪些实际操作。
感染迹象
用户可能会注意到下载或临时文件夹中出现不熟悉的临时文件或安装程序残留文件、意外的后台进程、防病毒软件或安全警报标记与 Roblox 相关的可执行文件、异常的网络活动，或者在工具运行时游戏或系统行为发生无法解释的变化。
如何保护自己
避免从非官方渠道下载游戏作弊器、破解程序或修改工具。保持安全软件更新并启用，谨慎对待从论坛或视频描述中获取的安装程序，并定期扫描系统以查找恶意程序。正版游戏和平台无需第三方破解工具即可正常运行。
分析报告
一般信息
| 姓： | Hacktool.RobloxHack.WDA |
|---|---|
| 签名状态： | No Signature |
已知样本
已知样本
本节列出了其他据信与该家族有关的文件样本。|
MD5:
4c3adbe7b800d422053e4e55f76b6072
SHA1:
b2a5a64ba849e168c39b99d443ac93fda32dadb2
SHA256:
B5BCBD7F2DF1C2B04D90BA25040539DBB2062C7C673FD38CF48BB1DD3CA26343
文件大小:
1.49 MB,1488896字节
|
|
MD5:
432244a756743c63621e307b1a7162e7
SHA1:
2087086389c122930d0251f714155e56dd1f1e16
SHA256:
2281F80B1E9CA0395185F95CA4A6534C5805AB06FD3DCCA37A991CC02134693A
文件大小:
418.82 KB,418816字节
|
|
MD5:
a287b560a41eed9f5f690360018a4c23
SHA1:
5f85a89a9a6e4a9507092a9df1e162ddff9d1f55
SHA256:
B06DF9E2BC40AE51D1A2BE9FC736B8F97D861970E373BD838D05B6A750C8A4C3
文件大小:
389.83 KB,389832字节
|
|
MD5:
9b21a7ae1216720590bfc8fcca8b1dce
SHA1:
8638774f03281df46f43998682c54c3dedda0382
SHA256:
7BDAE89DEE37117E732704680E9C4EEBD5D3C201011266E9A527DB22D2F97953
文件大小:
373.25 KB,373248字节
|
|
MD5:
9dc6a159f18923336f3e39e8c844e2f1
SHA1:
7493738c2519016e750878d6c91021f684cc5acf
SHA256:
203AE46DA44E96060B4497A6D552FD1F63E6CCA933988130A17CD9B0B81245E3
文件大小:
5.06 MB,5062656字节
|
Show 71 more
|
MD5:
e1ee14d62177f2a16171ad8818230132
SHA1:
558b09ceb3c4a0bacfb2f54fccef240b8daf17bd
SHA256:
F105292FDDA926BB2E8C8F411865076C36A45E31C13029A9B50C3D7C7DCEF283
文件大小:
1.76 MB,1758720字节
|
|
MD5:
9b8c591e1211fc94c3726bae0e0ed874
SHA1:
1719abfe329bc64f98e3e4b02e1dd4d073627e81
SHA256:
EF08BFDA0A6B34137A9B09DD71871CAF343E03C67B02B4ABF155744C026E9318
文件大小:
4.02 MB,4024320字节
|
|
MD5:
bb08dfbb6db42272ca779577ced5931e
SHA1:
4584a30d021dc989aa11ae481fe6f3a1b5a27505
SHA256:
9AAE190A785D739604606999DBBBA2AA35C0690F7EA2F1ECB18A6F186B2AD899
文件大小:
509.44 KB,509440字节
|
|
MD5:
09b59d9caeaac8ee09e6523609de874a
SHA1:
c6f9e554f7e56ea20c74e119d030fa00346ff46b
SHA256:
A993D0174C54E075BF0CA684B62D9B457C838901F149646EAE0ADE9B6BFC495F
文件大小:
3.67 MB,3665408字节
|
|
MD5:
028a74ecc2eaafd0d6c538da62613d2f
SHA1:
f85ad87d90981eb88ea1bb354fd541019231c73b
SHA256:
D1CA3B4587F7AE31FADA6FFE4E60FECCF456E527FC6700A3B76DB146DA9FC1FB
文件大小:
6.13 MB,6129336字节
|
|
MD5:
6c591bdaffb1e9cdb5f298f1b3672a4c
SHA1:
19506b9058df2b107a0c54265a79e4da1024ba5e
SHA256:
E03E13E6FCF2E5B30E77C627F90DBAAA7FB864CCA3729E36C92C9FB61E1ED444
文件大小:
2.61 MB,2606109字节
|
|
MD5:
1ecc64387b42ae881952e4f903f0ee28
SHA1:
e587facf61a8849db1833d4b0a9819083ca04f79
SHA256:
5D9971C03D0F301D4DA0DF8130E67ED6CBD7C35A9E2DF424251E9178880A8D2D
文件大小:
4.16 MB,4159722字节
|
|
MD5:
019dd0bbacd463a5cab938b68dc9fee4
SHA1:
30231618968ff8cf3206c6b557c0acbb49f0b51d
SHA256:
B2DB98D8825ABEC186A10A7326D11BA44409D90156AB2101588F2FB9616BEDAF
文件大小:
1.51 MB,1513984字节
|
|
MD5:
d011d7bcda1146d44cffa705b32a84aa
SHA1:
fa19e7831109988738e465123ae5f7cc3f6fb4ba
SHA256:
E6DFB9CD3CEE2E5C570C21432C0FB5BED618A3E2B3D4EA1CB2DD44ADB84BF459
文件大小:
187.90 KB,187904字节
|
|
MD5:
c2d3fb1104c57cc5d9dc5f3b80f5063c
SHA1:
a456e9b67c6f6d4d9ab9ebe7a8b043604226dc83
SHA256:
5C41132E5F4A09DBEA04E354F05E1871BEBBFD7815B1F2C44E0BE5C2FC2879B0
文件大小:
941.77 KB,941768字节
|
|
MD5:
55b04998be8049d5dc6384bbd35cacae
SHA1:
bf0a9619810bbf4a66b85038d39639705b2abf5d
SHA256:
4657B3CBC84718426A3DCB6115D1D351A95182115C0C104B2F9A35B945281217
文件大小:
131.58 KB,131584字节
|
|
MD5:
29b675a2d0764615532e98f3ab44c916
SHA1:
9978cf526d571e015e2ed154fab534f2d3c70490
SHA256:
50A8AB2B6F901F314C712589E709AA6F84E49CBADFE0402B3B4C56F06F07FD32
文件大小:
1.90 MB,1902080字节
|
|
MD5:
8b80c64e2853a8b5516531148dfeb4bc
SHA1:
069ed7c2b7e5852798c36c11bfd23ceb07672684
SHA256:
6A42262974F0E086C1F2DEFAFF4CCD9FB25046CF193422135E2DDA5B4B29B2A2
文件大小:
9.94 MB,9943040字节
|
|
MD5:
bb8c6139dc30ce869b68f30b18a4e629
SHA1:
adcb37cbf4ee8dc2b7600ec560e8dfc1c39110d6
SHA256:
DE0F71D193A2FC452192BF57BB4FB1F14C6E3E98C97E4F343D3B1D89997B5B17
文件大小:
2.65 MB,2653696字节
|
|
MD5:
a9c9367d56457f10b73ee1f4678f1a44
SHA1:
2edbba40cb63a5da42939f612f667bc107c1b4aa
SHA256:
28A186C9C7E2EB1E74B789037D269289F6F0D06EE1B801DA8905BD1D1523F07F
文件大小:
244.74 KB,244736字节
|
|
MD5:
6d0071858f5832162e6f30217c0af9e2
SHA1:
09353d05ba615caa18c56de0a051c483ca002378
SHA256:
589A01B51B3C35830C5D22181F6AB0285894CE7BE9848880F774EAB45209938D
文件大小:
1.50 MB,1495552字节
|
|
MD5:
248c470911c5016a967966bcbabacd89
SHA1:
9fdb7b142030e1ceaffa698a76cf0ea71235e55d
SHA256:
7DF10562C24DABB04A83790A44840E1949491E918DC506D4FF43086D9F753B12
文件大小:
2.38 MB,2378748字节
|
|
MD5:
2fc40fdc72a9b34bf76e27849c86e3e5
SHA1:
a8902eaf2e6cadc512e85528495c615dd4cf7748
SHA256:
54DD417426A20FE81789BC33CEE38C03EF53BB0D6DE043DAD5282E3D0EA2BF53
文件大小:
1.90 MB,1902080字节
|
|
MD5:
5ce79f6d510e53a845f42302683fb87a
SHA1:
96f0c7aa3c9ed8b24c15315cc951a7f30a08fa3d
SHA256:
CD4070DD7245EDCDFB466A066627CA5A29394062D5FA2B3E46F2B9A3F43B03D7
文件大小:
2.11 MB,2107904字节
|
|
MD5:
30a1f07187e4b31dfaabd2cdd56d8acf
SHA1:
33b29d6e317024ba2a02a062f39e8b2afdae3c8e
SHA256:
EF8B1E30B32B0E579A262CAAB827493DA4C3D1364C3C28169D94D2C123D14124
文件大小:
205.31 KB,205312字节
|
|
MD5:
6cb7fb32ad159656b24458a30809c393
SHA1:
489e04e1d4efe89971bdeab1aeda87783a313732
SHA256:
4448157ABDD68A4C928F6E6A33E65689D55CAA6787699C4FF7EF09744D75026D
文件大小:
373.25 KB,373248字节
|
|
MD5:
db9bfee8359e7d936689e0cf662dd0aa
SHA1:
b0c945730ca3c05db81ca3864115146a6db54724
SHA256:
7C7E331A0ED315EDE767624B8FC0FCCCF143053583E6BF0E76078F2E545DB22D
文件大小:
384.51 KB,384512字节
|
|
MD5:
efd01ee5dc4cc227cbc42800c651a843
SHA1:
8fdde38d1389d36271f2158c5c0e3ac322f64cd4
SHA256:
316EC3375FC7C9D0CEB5564FA2A6BE57CAFD77F3ED267153002C02774C66F734
文件大小:
1.11 MB,1113600字节
|
|
MD5:
df307d0e141fbba3e069b79215cf1102
SHA1:
5b5a2a478dfa3fa129a207e09191f4e7f2104a77
SHA256:
CB3295D3EF77A2EDE45B1C4793539355664C5693B0922486CD382186AE31C2BB
文件大小:
3.67 MB,3671552字节
|
|
MD5:
537726d843a8dc087b1f75d80ea01cca
SHA1:
bc2482f9dd1b7daee7925cd2bf1c631f6fd44bd6
SHA256:
DE140F574E495BA37ECC19A2C27ABB28939410B39D9794E8680A172A2F5937A6
文件大小:
972.29 KB,972288字节
|
|
MD5:
54f00266ce900596add7225c775ef1c3
SHA1:
de8fe40d4ea3a2ef1848a164cd928591d4c1b0cf
SHA256:
3B983E43065539CAA7122B3FE3267EC722A0BD7230AB2791184017F99DB24B6B
文件大小:
175.10 KB,175104字节
|
|
MD5:
afcc95e7da1813fa8e9592f046a9886c
SHA1:
1c80c6afcd19996e5cc2e508eb04952fbce97e52
SHA256:
705A225A62D407419CD5F20998867F5365297A322EE805251112F6D9935327DB
文件大小:
292.35 KB,292352字节
|
|
MD5:
23014851982ac848f01170b361b7bd99
SHA1:
f5292299ea880fa852f501f39dcb113b718dcb8e
SHA256:
E0530B0EACB5DD6E48677C822D9184A4CAFE1EF0C45B3A1874800C5E0F855D0D
文件大小:
7.09 MB,7090792字节
|
|
MD5:
7f11cd103f1546ac973117917eaf1545
SHA1:
88d56b356f54afbaf4ebe554128200cb92e262eb
SHA256:
B21F3881DE1C7A56145C0D59CB38AB76DD35875242DF7E6E9CD8024DB4676AC9
文件大小:
276.48 KB,276480字节
|
|
MD5:
2bc854c5f5448482df75991e5d383136
SHA1:
34ec67875082893aaf9d964a8fa76c98f1e56f1e
SHA256:
2DF0E1AA18A20290AECDD09D1C25D44EE07518116BB8D169011BCAB8DAD9BF2A
文件大小:
333.31 KB,333312字节
|
|
MD5:
3cc99fd19e2fd64e27e697d7f6a0fa8d
SHA1:
f44324ddf45b2428ac962c52bc7c6688bcb923f9
SHA256:
97D391A216C7A39A28F94827D1134B117788E4D27C7E71AE530BF6A25621B6ED
文件大小:
391.68 KB,391680字节
|
|
MD5:
785be65f4760f27a2b6f057aee50f8a4
SHA1:
053311cc462e07bee243b6ce1fb6d6819bd29d29
SHA256:
6E5A0658EF0392BD0C0132D8514F8801E0131F137C37AF56B986A6E587334386
文件大小:
2.61 MB,2607095字节
|
|
MD5:
73b5a40138741c129ff46364b2a5a792
SHA1:
dda283ece0802819a24dae0033ff385c31c301c8
SHA256:
BB31E33BB0CE7B769CFC292256E85E629BC87955BAA8ACC120F26C94DBA6BF79
文件大小:
393.63 KB,393632字节
|
|
MD5:
67fee333eca6bbd3c22a0785d05d4055
SHA1:
cb199be7444ac52208430972b83bb216af7fbe97
SHA256:
7C9ECA13D5F189DEFC0BCC8C65FB2FB068D6953B26B5A24EE30052C864ED12E1
文件大小:
128.51 KB,128512字节
|
|
MD5:
8bae590ad31b5bc60a63eca68033c94d
SHA1:
f32d328982c1d873afdaa6dcf3098924d571e4fa
SHA256:
B81A0A14DCA39788665562DCA80FAFA45298439EDDEC17EC3042CD10E6F7C655
文件大小:
600.06 KB,600064字节
|
|
MD5:
ea2291d33cfff27c00b77b5e6fec84ad
SHA1:
7bd3a4472dfe7e64d97726c7e134ed9671510a5e
SHA256:
08930FBBC2D880B1B96E6B99373E572AB65A4559CE9363721CE4F6828E61AED8
文件大小:
695.30 KB,695296字节
|
|
MD5:
8d4928ada3aefc22abff2bb9ed753901
SHA1:
d6a40c750bd1216095355ac81b806e752e6434d0
SHA256:
AB2D2564567FEE6FC4F18B4BC19679BC3B7078F37AFFAE4509C015D4C6A669B8
文件大小:
509.44 KB,509440字节
|
|
MD5:
a2523bdd188bcfc68f5af61b2f2206ec
SHA1:
25e6c78aaa9872b0ea5258eb864c9a697cc1ee19
SHA256:
B4F6DBA10B6EF6A91A6305B8337CEF8FBAC0CB3374E6B6346C8BBB748C37F5CE
文件大小:
1.51 MB,1513984字节
|
|
MD5:
d8a002f4a7edccda02bd8fb88b271a6f
SHA1:
608785ee8f99adce541d320dbe851848881346cc
SHA256:
008FE745D63C8EEA95976BE6714C00FB42A3625ABCB23A87E7A7B33B142D6A4B
文件大小:
4.05 MB,4050944字节
|
|
MD5:
ebbdccafc417a9186ec984d997aa038d
SHA1:
9dd34073cba0968a437837a4977f7a4724a75dd8
SHA256:
777954FB2AB024505C1672757CF07CA42D29C81BC85F6C16B2DC358B19BA8B08
文件大小:
28.16 KB,28160字节
|
|
MD5:
3f043294e3bdc8f8e8714983beb3696a
SHA1:
3ed4cc6a026aa2a2f5739ae85234a7dc14bc7ff2
SHA256:
229339ED78DCEF722199842BA1CA2DC75FE0E0F7678B1A328DDE4ABDD0475549
文件大小:
456.70 KB,456704字节
|
|
MD5:
762b8ebc72d3d1d46e25e933fbf9d30d
SHA1:
bbd600d3b2d74b552698b3bbee9ad4d3ec49851d
SHA256:
7481CBCA6F20C9CFE1B577AF490E5FD9B033215EDC82E4474FFA6A69AFF5D150
文件大小:
595.97 KB,595968字节
|
|
MD5:
c0a53f2f11ca90351798ce4d2b6ec13d
SHA1:
edc5a6c6f53603746349addd85e89f7348bbb3df
SHA256:
7F6A092A1253942412490CE6D8265DE58D1A895CAE27B71B49F072723A09185E
文件大小:
4.00 MB,4003332字节
|
|
MD5:
6c0b55f9018f4916b627d99b2d87dde4
SHA1:
6a2ef5e987f7b9c62eeb94fc9bdcb0f65c601be1
SHA256:
AF01CB6561787F474B87FA3A3CB52247D98B6C48A137014A1ED893F00091A006
文件大小:
160.02 KB,160024字节
|
|
MD5:
241915147148998cadbeca43169d45f5
SHA1:
80ce37dddd86840a4a4ac7c455a5b5fd8e93fd9c
SHA256:
84A2614D25FA0C19AB25D4D6C5FE5F378A1192095836815E81B72B2388F4BAFF
文件大小:
529.92 KB,529920字节
|
|
MD5:
733da073571a8d6d0d0e27bd2454afd7
SHA1:
85ca846bbb1bc58b1e75b1464f731338e08bfb49
SHA256:
FC770A60FDF9D4531F1792D90B95EF8F033F583F4257B3DA513F5C6BE7BE49CB
文件大小:
9.43 MB,9430016字节
|
|
MD5:
ab3ceaa84ad9863d22fb3e93860a0349
SHA1:
cae3561d5d1e749c9745c02c01c94d9b3d0496c0
SHA256:
5F082128167A5C9985EE13E4473B1A732BB31B25DB925570593377C87C069B7D
文件大小:
334.85 KB,334848字节
|
|
MD5:
18f10bca2b80a4b7ef41253a5cf193e2
SHA1:
1d197d1944f415457d31dfcaa4f8f1d10df9e836
SHA256:
22994C14D4BB563DD6CB46A71AF32F34309482F4F991BA3D0CEC0227AAB4930C
文件大小:
663.55 KB,663552字节
|
|
MD5:
82c52cd3afc70a424d6bde7cd7272107
SHA1:
c8c9471d1c47e44c5a25c2fe4bc9b8eeb6a9f514
SHA256:
8B1ED20807EAE1E887B6CDACD32ABF4A05E68B3181CD9851FD7EA710A0078377
文件大小:
347.10 KB,347104字节
|
|
MD5:
a4256384f6206ff6b805ada1e1caed99
SHA1:
e01e076b090cb16be0269ffce46738e40cb674e1
SHA256:
BEAF0D98A38703CD4052A69ABD971510FCA51976649E3FEA1018A4755EE7027F
文件大小:
4.92 MB,4923392字节
|
|
MD5:
f36ff2dd24c9abb77027be02e38f76d7
SHA1:
dafd147d8cd315e6667c0d67c5b3acf74fa4d005
SHA256:
64EEFF3D0EC2DCC752C0C3F00466CB9FE53D1FD7BE8792E17BB3BD9E691EF8C7
文件大小:
424.45 KB,424448字节
|
|
MD5:
89a6dace1113c73648f7488fbbdc07e4
SHA1:
878b54fcfdeb89c30cb4b2889496f07f6b5b365a
SHA256:
1A55E3A0C5CAEEB3BDD34B2A304C7C9E562E37D4D0A185BC9C0E6F69BE012DC9
文件大小:
61.95 KB,61952字节
|
|
MD5:
37e0fd26420cfa480935692df9cecb7d
SHA1:
20119205349dc5215633439450feb05ee724e189
SHA256:
8E965756481CAA120D43B2587E4CD60C67385CE63C38F6DBCB73666D448EFBAD
文件大小:
4.82 MB,4824300字节
|
|
MD5:
4e834f0f48db99133def97884f93929d
SHA1:
93e50ba1962015bac9efe913d657f58b8e7a14e4
SHA256:
08D6149BF390A94DC31D4F205EAB81361F9282004DE10F15C8617DDB82B6FC99
文件大小:
1.64 MB,1639936字节
|
|
MD5:
85caf8d8f1e1a9f7b12222d2e5bb9a7d
SHA1:
60c5b6d5ef6ba1a853236ff081790fb6423caaa5
SHA256:
3B55D61F816D63B94CC468494A37392E39DDCA59E143B673BA49176BE0503E6C
文件大小:
9.92 MB,9918464字节
|
|
MD5:
d14590930c78a70ea9fbb4d1180ff4e3
SHA1:
dfc81914f2f85e52677d522820e0631cc341b3f2
SHA256:
69B64F2163B61385CC6834882B8C9386F60611C15267CC7C8E518D9307BF6600
文件大小:
173.06 KB,173056字节
|
|
MD5:
1188a6b9061e1622afa5e2681a20bc63
SHA1:
029de2e4e2ef777d2254e22c58c722535d8090c2
SHA256:
2A39CB4816D314046BDF7C46EDF45BDB15AB261CF675C55273D89A49BBF88D59
文件大小:
782.34 KB,782336字节
|
|
MD5:
95f3c371b3a744af09b43bf1370c8fa7
SHA1:
aabe1c034c6d1e5270a35591a9d9d0026646a936
SHA256:
16B666E31D3FD3CE7827CE295080CDF43530C6274A3E136A67A1E7C91F646F09
文件大小:
75.26 KB,75264字节
|
|
MD5:
ed78bd5453756aed66a8346fecddf7b6
SHA1:
9f7101373ca8fd6cdeb94ffede1c992ea92c6786
SHA256:
0D6C1F27B1EE5677BE18583A2B7A158B2A3CAE3F40321414485F2D298CA73867
文件大小:
6.31 MB,6314496字节
|
|
MD5:
96191996abd7965b61fa5f1785208f38
SHA1:
51b380276765b8dfe6590143037a1dd1bb99682a
SHA256:
BFD5CD9A61E7AC779113A85860E2513A7F62C28C39D0846967422D6940E842EC
文件大小:
8.41 MB,8407040字节
|
|
MD5:
2ab9b73af9ddd13e4198ba392661032f
SHA1:
71ed9d73c1756aad718c9acfa7bd0ad9c6c0fa9a
SHA256:
4C258E9BEF0145C9099244D4A9B0B68602F746D561B195862FB7D27945987D77
文件大小:
279.55 KB,279552字节
|
|
MD5:
2dc7dafe94770abe36bab77e7ee8ca16
SHA1:
b91025ad59b4d862ceea01b9562d14b8b355d5c8
SHA256:
A6861EB58E0BCFCCFCDA16641CAFBD40A83EA007F736CA1C3938521CDEA26147
文件大小:
5.28 MB,5277184字节
|
|
MD5:
abb79402178d8da3b78eaef86d84299c
SHA1:
104027caa90d2dd22a2f19f8eb9872451b616e78
SHA256:
D94184FD0FA43728064EE7FDEB1F3CA19C71D485C353DA82C9E779E376C7050F
文件大小:
237.57 KB,237568字节
|
|
MD5:
2ab77ffabcf1bfd93db97b24a335c0b3
SHA1:
ba982ec75c0b0c9e44a5a1aff5dd4d7350193f18
SHA256:
F0A97B78F34C28DC8B99D1C64FCA01BA738D567BB895F68181295DBD5DAB77F0
文件大小:
1.65 MB,1650176字节
|
|
MD5:
03b3dd1f63c022d422e301f6bf3ee454
SHA1:
855386845c001a2476120a1f053c85a8c561b311
SHA256:
64F06E1EC8AC6FBA698DABA89557E04D73FF9045BB3EAE022AC3D02CAEBF6A01
文件大小:
1.80 MB,1800776字节
|
|
MD5:
8a67d6571d72f82cefb8f8b1043c81c3
SHA1:
1603f60022d2e9fe929cdd5cd43f5b5db08850d8
SHA256:
7A955D2E0D01053D28F7DE6186CC0E61667C563D508D8B336734F5C79AB5AE7F
文件大小:
61.95 KB,61952字节
|
|
MD5:
784df1ae9c5778606186ed06a7cd1b75
SHA1:
c589878ce3df544c2e1fa22d97816a7a6db3fb99
SHA256:
9B80112CF026C942ED3F1D61148733EEC81F86A8F7708E6A71E498E809FC5F79
文件大小:
223.67 KB,223672字节
|
|
MD5:
cb3bcfd6a83ded6e2f226fe13e6e6018
SHA1:
042413ffe34715b393a6a4c3b65df1861edbc703
SHA256:
14199F25DC62D029E231CB16C337AD1A0F9DC1F0F71E226052EF66312D64E74D
文件大小:
527.36 KB,527360字节
|
|
MD5:
2c08b3c96c83baa99af3a33202bc2824
SHA1:
f8931cd2d2c54d2c8f9edb7bd970dbc4855de932
SHA256:
A0A2F453C63C46B1EA41286393E6215EE1C30117CE168E8DB8926DDFDBC41D54
文件大小:
4.92 MB,4922744字节
|
|
MD5:
3676eb1696ccc78f41677e75b7a367f1
SHA1:
142afcfee9cac81da057f5b3efa6131930414296
SHA256:
B860CFB8ECC240F32334A996901E9EB87FDBC19B8399B55B0E481B0242490C06
文件大小:
1.69 MB,1693696字节
|
|
MD5:
83c26c00df1597c56fb938273240ffa4
SHA1:
6434fee8c05cb11778efdb645b23a7e7f153c1eb
SHA256:
7332175DBB8F833ED47E5AC2EE1F1AFB325B21B27CB353A27EC7AAC14850A582
文件大小:
2.88 MB,2877952字节
|
Windows 可移植可执行文件属性
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is 64-bit executable
Show 7 more
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
文件图标
文件图标
本部分展示了在恶意软件家族样本中找到的图标资源。恶意软件通常会复制与合法软件相关的图标，以误导用户，使其误以为该恶意软件是安全的。
Show 12 more
Windows PE 版本信息
Windows PE 版本信息
本节显示此系列样本的 Windows 文件版本信息数据结构中已设置的值和属性。为了误导用户，恶意软件攻击者通常会添加伪造的版本信息，模仿合法软件。| 姓名 | 价值 |
|---|---|
| Assembly Version | 1.0.4.0 |
| Comments |
|
| Company Name |
Show 10 more
|
| File Description |
Show 22 more
|
| File Version |
Show 18 more
|
| Internal Name |
Show 13 more
|
| Legal Copyright |
Show 10 more
|
| Legal Trademarks | MIT License |
| License | https://curl.se/docs/copyright.html |
| Original File Name | libpq.dll |
| Original Filename |
Show 9 more
|
| Product Name |
Show 20 more
|
| Product Version |
Show 18 more
|
数字签名
数字签名
本节列出了该系列样本所附带的数字签名。在分析和验证数字签名时，务必确认签名的根授权机构是知名且可信的实体，并且签名状态良好。恶意软件通常使用不可信的“自签名”数字签名（恶意软件作者可以轻松创建此类签名，无需任何验证）。恶意软件也可能使用状态无效的合法签名，或者使用来自可疑根授权机构且签名者名称虚假或具有误导性的签名。| 签名者 | 根 | 地位 |
|---|---|---|
| Ashampoo GmbH & Co. KG | GlobalSign Code Signing Root R45 | Root Not Trusted |
| Goat Systems Interactive | Goat Systems Interactive | Self Signed |
| MIKOM INC | SSL.com EV Code Signing Intermediate CA ECC R2 | Self Signed |
| COREL CORPORATION | SSL.com EV Code Signing Intermediate CA RSA R3 | Self Signed |
| Hetman Software | SSL.com Root Certification Authority RSA | Root Not Trusted |
Show 2 more
| SimpMusic | SimpMusic | Self Signed |
| Test certificate for 'FluxDown [OSS]' | Test certificate for 'FluxDown [OSS]' | Self Signed |
文件特征
- CryptUnprotectData
- dll
- fptable
- GetConsoleWindow
- HighEntropy
- imgui
- No Version Info
- ntdll
- VirtualAllocExNuma
- VirtualQueryEx
Show 2 more
- WriteProcessMemory
- x64
区块信息
区块信息
在分析过程中，EnigmaSoft 会将文件样本分解成逻辑块，以便进行分类并与其他样本进行比较。这些逻辑块可用于生成恶意软件检测规则，并根据共享的源代码、功能以及其他显著属性和特征将文件样本分组到不同的家族中。本节概述了这些逻辑块数据及其 EnigmaSoft 分类结果。如果可用，还会显示逻辑块数据的可视化表示。| 总区块数： | 4,899 |
|---|---|
| 潜在恶意块： | 12 |
| 白名单区块： | 1,915 |
| 未知区块： | 2,972 |
可视化地图
... 数据已截断
0 - 可能的保险箱
? - 未知区块
x - 潜在恶意拦截
? - 未知区块
x - 潜在恶意拦截
相似家庭
相似家庭
本节根据 EnigmaSoft 的分析，列出了与此恶意软件家族具有相似性的其他家族。许多恶意软件家族都基于相同的恶意软件工具包创建，并使用相同的打包和加密技术，但各自扩展了独特的功能。相似的家族可能共享源代码、属性、图标、子组件、受损和/或无效的数字签名以及网络特征。研究人员利用这些相似性来快速有效地对文件样本进行分类，并扩展恶意软件检测规则。- Agent.GTS
- Agent.MIFH
- Agent.MUFB
- Agent.NYB
- Agent.PTA
Show 19 more
- Downloader.Agent.WBG
- Dropper.X
- Dropper.XF
- Filecoder.XSA
- GameTool.GH
- Kryptik.YKBB
- Marte.DA
- SnakeLogger.C
- Spy.Agent.GY
- Spy.Agent.LWA
- StealC.C
- Trojan.Agent.Gen.EYR
- Trojan.Downloader.Gen.AGW
- Trojan.Kryptik.Gen.IHA
- Trojan.Kryptik.Gen.IIG
- Trojan.Kryptik.Gen.IJB
- Trojan.Kryptik.Gen.IJL
- Trojan.Kryptik.Gen.ILS
- Trojan.Kryptik.Gen.LAW
文件已修改
文件已修改
本节列出了该系列样本创建、修改、移动和/或删除的文件。文件系统活动可以帮助我们深入了解恶意软件在操作系统上的运行方式。| 文件 | 属性 |
|---|---|
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-0254m.tmp\9fdb7b142030e1ceaffa698a76cf0ea71235e55d_0002378748.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-51tfv.tmp\053311cc462e07bee243b6ce1fb6d6819bd29d29_0002607095.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-f9g9v.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-kumhn.tmp\19506b9058df2b107a0c54265a79e4da1024ba5e_0002606109.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-o27ks.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-vkhj7.tmp\_isetup\_setup64.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Show 22 more
| c:\users\user\appdata\local\temp\nsf633a.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsf633a.tmp\modern-wizard.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsf633a.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsf633a.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsh5798.tmp\modern-header.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsh5798.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsh5798.tmp\modern-wizard.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nsh5798.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsh5798.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nshd467.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsn305f.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsp628d.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nssd4f5.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nssd4f5.tmp\modern-wizard.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nssd4f5.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nssd4f5.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nst31b8.tmp\modern-wizard.bmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nst31b8.tmp\modern-wizard.bmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\nst31b8.tmp\nsdialogs.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nst31b8.tmp\system.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsx5759.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\windows\debug\mpt.txt | Generic Write,Read Attributes |
注册表修改
注册表修改
本节列出了此系列样本创建、修改和/或删除的注册表项和值。Windows 注册表活动可以提供关于恶意软件功能的宝贵信息。此外，恶意软件通常会创建注册表值，以便在初始感染系统后自动启动并无限期地持续存在。| 键::值 | 数据 | API名称 |
|---|---|---|
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n % �v����Bx (�1`1�1HO @V� A��H[uN$b"hk`k�qw�n{b��P� ��!���� � ��3�� ��� ������ ��m� Ù� �V ����$�8წ���l� �&M �~ �=�SB1_ T�Vw���%�������� �AE��D��&��$���L A *�" C �� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n 5 �vT�����Bx #��&� (�(X�1`1�1HO @V� A��H[uH�pN$b"hk`k�ql(�tǤw�n{b��P� ��!�����7� � ��3�� ��� ���������.� ��m� Ù� ƾB�IV �gi�V ����$�Ac�8წ���Κ�l� ��j�&M A�~ �=�SB1 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n - �v����Bx &� (�1`1�1HO @V� A��H[uN$b"hk`k�ql(�tǤw�n{b��P� ��!�����7� � ��3�� ��� ������ ��m� Ù� �'N�IV �V ����$�8წ���Κ�l� �&M�� �~ �=�SB1_ T�Vw�`�V��%�������� �AE�z | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n # �v����Bx (�1`1�1HO @V� A��H[uN$b"hk`k�q{b��P� ��!���� � ��3�� ��� ������m� Ù� �V ����$�8წ���l� �&M �~ �=�S/� B1_ T�Vw���%�������� �AE��D��&��$���L A *�" C ��| | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n # �v����Bx (�1`1�1HO @V� A��H[uN$b"hk`k�q{b��P� ��!���� � ��3�� ��� ������m� Ù� �V ����$�8წ���l� �&M �~ �=�SB1_ T�Vw���%�������� �AE��D��&��$���L A *�" C ��| | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �l �v����(�1�1HO @V� A��H[u_�zb"hk�qw�n{b��P� ������ ������ ��m� Ù� ����$�8წ���&M �=�S/� B1_ T�Vw���%������ �AE��D��&��$���L | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �n . �v �Z����Bx #��(�1`1�1HO @V� A��H[uH�pN$_�zb"hk`k�ql(�w�n{b��P� ��!�/��Hu���� � ��3�� ��� ����X���� ��m� Ù� �gi�V ����$�8წ���l� �&M A�~ �=�SB1_ B�� T�Vw���%������� | RegNtPreCreateKey |
Windows API 使用情况
Windows API 使用情况
本节列出了此系列样本使用的 Windows API 调用。Windows API 使用情况分析是一项宝贵的工具，可以帮助识别恶意活动，例如键盘记录、安全权限提升、数据加密、数据泄露、干扰防病毒软件以及网络请求篡改。| 类别 | API |
|---|---|
| Syscall Use |
Show 90 more
以上未显示另外 14 件商品。 |
| User Data Access |
|
| Network Winhttp |
|
| Network Info Queried |
|
| Anti Debug |
|
| Network Wininet |
|
| Keyboard Access |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Service Control |
|
| Other Suspicious |
|
Shell命令执行
Shell命令执行
本节列出了此系列样本运行的 Windows Shell 命令。恶意软件经常利用 Windows Shell 命令进行恶意活动，例如提升安全权限、下载和启动其他恶意软件、利用漏洞、收集和窃取数据以及隐藏恶意活动。
"C:\Users\Zyuutuvx\AppData\Local\Temp\is-KUMHN.tmp\19506b9058df2b107a0c54265a79e4da1024ba5e_0002606109.tmp" /SL5="$160196,2164709,131584,c:\users\user\downloads\19506b9058df2b107a0c54265a79e4da1024ba5e_0002606109"
|
"C:\Users\Nubhhqjr\AppData\Local\Temp\is-0254M.tmp\9fdb7b142030e1ceaffa698a76cf0ea71235e55d_0002378748.tmp" /SL5="$1F001E,1939940,131584,c:\users\user\downloads\9fdb7b142030e1ceaffa698a76cf0ea71235e55d_0002378748"
|
"C:\Users\Tdusnrbw\AppData\Local\Temp\is-51TFV.tmp\053311cc462e07bee243b6ce1fb6d6819bd29d29_0002607095.tmp" /SL5="$F028E,2165696,131584,c:\users\user\downloads\053311cc462e07bee243b6ce1fb6d6819bd29d29_0002607095"
|