9月份采购样品清单.hta，HEUR:Trojan.HTA.Alien.gen，火绒静态不报未双击

3306-1

来源：https://www.52pojie.cn/thread-2126791-1-1.html
发现：VVVVVVV
抄送：@火绒工程师

发现者描述

1. 最近淘宝老是有人发什么采购文档

复制代码

文件指纹
9月份采购样品清单.hta
大小: 2015907 字节 : 1968 KiB
CRC32: 9551AE06
CRC64: D5A50E371578482D
XXH64: 09B3A552C10E4E4E
SHA256: 8032c9e900d1938d49eb2e21e0ded7e4ea506c98b252610bdd2b609773e5a42a
SHA3-256: a04d61fab820fd1b07309966316f8836a677e7617a7bbe0ec67d070491051e14

package.zip
字节 : 1.9 MB
SHA256: 47ed6f4780a119c759c53d6451f5cfd9c4af38800da55287c73557f34d22d6ea

avq.exe
Poltarbi.exe
字节 : 4.94 MB
SHA256: 2a10bee5e24ec929918b68ba24288700f6a8d8ff1687f80e97ea4cac7041c69b

forge.exe
make.exe
handler.exe
launch_patch_aacb42.bat
DDC87699A36825C5.cmp
handler_verify_2aba29.bat
system_update_7459d4.bat
因简单手工静态分析，衍生物未能手动静态提取

火绒扫描（我自己的本地扫描结果）
6.0.11.3 版本
09-06 18:37 病毒库

2026/09/07 15:24:19
病毒防护
病毒查杀
自定义扫描(手动执行)，发现0个风险项目

病毒库时间：2026-09-06 18:37
开始时间：2026-09-07 15:24
执行类型：手动执行
扫描类型：自定义扫描
总计用时：00:00:01
扫描对象：1
扫描文件：1
发现风险：0
已处理风险：0

参考病名

1. HEUR:Trojan.HTA.Alien.gen

复制代码

文件属性

1. file is not EXE or DLL ... ( E3 F8 B0 B7 A7 B3 B3 B3 .. > 泺胺С吵怀*嚟頜?<
   
2. 
   
3. 类型
   
4. HTML 应用程序
   
5. 
   
6. 程序标记
   
7. <hta:application
   
8. 　　singleinstance="yes"
   
9. 　　selection="no"
   
10. 　　scroll="no"
    
11. 　　minimizebutton="no"
    
12. 　　maximizebutton="no"
    
13. 　　innerborder="no"
    
14. 　　showintaskbar="no"
    
15. />
    
16. 
    
17. 疑似静态部分恶意字符串
    
18. "del "%~f0"\r\n";
    
19. var _zn = "package.zip";
    
20. var chunkSize = 262144;
    
21. "_" + randBatId + ".bat";
    
22. var data = stream.Read();
    
23. "cd /d "" + workShort + ""\r\n" +
    
24. data = _xm(stream, _zs, _xk, _x2);
    
25. var zipPath = workDir + "\" + _zn;
    
26. var exePath = workDir + "\" + _en;
    
27. if (!_xz(zipPath, workDir, exePath)) {
    
28. var tmp = S[i]; S[i] = S[j]; S[j] = tmp;
    
29. if (parent && !fso.FolderExists(parent)) {
    
30. var b = b64lookup[b64Str.charCodeAt(i++)];
    
31. for (var i = 0; i < 256; i++) b64lookup[i] = -1;
    
32. "start "" "" + exeShort + """ + argsPart + "\r\n" +
    
33. var tmpStream = new ActiveXObject("ADODB.Stream");
    
34. var shellApp2 = new ActiveXObject("Shell.Application");
    
35. var tmp = S[rc4_i]; S[rc4_i] = S[rc4_j]; S[rc4_j] = tmp;
    
36. j = (j + S[i] + key.charCodeAt(i % key.length)) & 0xFF;
    
37. var chars = "abcdefghijklmnopqrstuvwxyz0123456789";
    
38. var _sf = [".tmp", ".cache", ".dat", ".log", ".cfg", ".bak"];
    
39. var workDir = shell.ExpandEnvironmentStrings("%TEMP%") +
    
40. var path = decodeURIComponent(window.location.pathname);
    
41. alert("E3: " + (e.message || e) + " [" + (e.number || "") + "]");
    
42. result += chars.charAt(Math.floor(Math.random() * chars.length));
    
43. var batPrefixes = ["runtime", "service", "config", "system", "cache",
    
44. if (typeof _ck === "function" && !_ck()) { window.close(); return; }
    
45. if (bytes.length > 1 && bytes[0] === 0x00 && bytes[1] === 0x00) {
    
46. var randomExeName = legitNames[Math.floor(Math.random() * legitNames.length)];
    
47. var drive = fso.GetDrive(fso.GetDriveName(shell.ExpandEnvironmentStrings("%TEMP%")));
    
48. var b64Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    
49. try { _re(exePath, workDir); } catch(e) { throw new Error("E5:_re " + exePath + " " + (e.message||e)); }
    
50. var envVars = ["%COMPUTERNAME%", "%USERNAME%", "%OS%", "%PROCESSOR_ARCHITECTURE%", "%USERDOMAIN%", "%NUMBER_OF_PROCESSORS%"];
    
51. var _sd = [0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255];
    
52. var legitNames = ["runtime.exe","helper.exe","service.exe","update.exe","launch.exe","worker.exe","monitor.exe","manager.exe","broker.exe","agent.exe","handler.exe","runner.exe","daemon.exe","core.exe","engine.exe","proxy.exe","bridge.exe","notify.exe","backup.exe","cache.exe","dispatcher.exe","watcher.exe","scheduler.exe","installer.exe","config.exe","validator.exe","inspector.exe","collector.exe","reporter.exe","analyzer.exe","processor.exe","converter.exe","adapter.exe","connector.exe","listener.exe","responder.exe","provider.exe","supplier.exe","consumer.exe","producer.exe","publisher.exe","subscriber.exe","coordinator.exe","controller.exe","regulator.exe","supervisor.exe","executor.exe","compiler.exe","assembler.exe","linker.exe","loader.exe","parser.exe","renderer.exe","formatter.exe","serializer.exe","encoder.exe","decoder.exe","compressor.exe","extractor.exe","packer.exe","unpacker.exe","validator.exe","verifier.exe","auditor.exe","logger.exe","tracer.exe","profiler.exe","debugger.exe","diagnostic.exe","checker.exe","scanner.exe","finder.exe","searcher.exe","indexer.exe","catalog.exe","registry.exe","repository.exe","storage.exe","archive.exe","sync.exe","transfer.exe","sender.exe","receiver.exe","client.exe","host.exe","node.exe","peer.exe","relay.exe","gateway.exe","portal.exe","console.exe","terminal.exe","shell.exe","prompt.exe","wizard.exe","setup.exe","deploy.exe","build.exe","make.exe","craft.exe","forge.exe","spark.exe","pulse.exe","signal.exe","stream.exe","flow.exe","pipe.exe","channel.exe","queue.exe","stack.exe","pool.exe","bucket.exe","vault.exe","safe.exe"];

复制代码

解析程序

1. 解析命令
   
2. %WinDIR%\System32\mshta.exe "9月份采购样品清单.hta"
   
3. 
   
4. 文件说明
   
5. Microsof(R) HTML 应用程序主机
   
6. 
   
7. 类型
   
8. 应用程序
   
9. 
   
10. 文件版本
    
11. 11.0.19041.1
    
12. 
    
13. 产品名称
    
14. Internet Explorer
    
15. 
    
16. 版权
    
17. © Microsoft Corporation. All rights reserved.

复制代码

释放文件

1. C:\Users\Public\DDC87699A36825C5.cmp
   
2. C:\ProgramData\Search\34f3ee81e944bc6b\avq.exe
   
3. %LocalAppData%\Temp\7595136E-5E9D-940A-108A-D27B50178C44.dat\make.exe
   
4. %LocalAppData%\Temp\D9D219FF-9B90-2F63-AEED-A50ABB89EDEC.cfg\handler.exe
   
5. %LocalAppData%\Temp\D9D219FF-9B90-2F63-AEED-A50ABB89EDEC.cfg\package.zip
   
6. %LocalAppData%\Temp\D9D219FF-9B90-2F63-AEED-A50ABB89EDEC.cfg\Poltarbi.exe
   
7. %LocalAppData%\Temp\3F8D35C4-DB8F-805D-07A7-4188CF209DB5.cache\forge.exe
   
8. %LocalAppData%\Temp\D9D219FF-9B90-2F63-AEED-A50ABB89EDEC.cfg\handler_verify_2aba29.bat
   
9. %LocalAppData%\Temp\3F8D35C4-DB8F-805D-07A7-4188CF209DB5.cache\launch_patch_aacb42.bat
   
10. %LocalAppData%\Temp\A320212E-86E5-6E3E-F74B-EFAA68D1FDE2.cache\system_update_7459d4.bat

复制代码

解压文件

1. package.zip > Poltarbi.exe

复制代码

移动改名

1. Poltarbi.exe > avq.exe

复制代码

启动脚本

1. cmd.exe /c "%LocalAppData%\Temp\D9D219FF-9B90-2F63-AEED-A50ABB89EDEC.cfg\handler_verify_2aba29.bat" "

复制代码

释放压缩
https://s.threatbook.com/report/file/47ed6f4780a119c759c53d6451f5cfd9c4af38800da55287c73557f34d22d6ea

解压文件
https://s.threatbook.com/report/file/2a10bee5e24ec929918b68ba24288700f6a8d8ff1687f80e97ea4cac7041c69b

样本情况
https://virusscan.jotti.org/zh-CN/filescanjob/tra71jurq9
https://tix.qq.com/search/single?keyword=aeeba05783eb456c525257f934cb979b
https://sandbox.dbappsecurity.com.cn/report/04b62fec-c035-400d-ab6a-e46600e3ce0c/flat
https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=AaB6tVMHV2qt4aPsZ0Pq
https://www.maldun.com/analysis/YXNkZmRzZmFkc2YxMzMyOTg2ZHNmYXNkZmFzZGY=/
https://fenxi.antiy.cn/#/entirety/file/searchResult?hash=aeeba05783eb456c525257f934cb979b
https://virus.cverc.org.cn/#/entirety/file/searchResult?hash=aeeba05783eb456c525257f934cb979b
https://www.virscan.org/report/8032c9e900d1938d49eb2e21e0ded7e4ea506c98b252610bdd2b609773e5a42a
https://www.virustotal.com/gui/file/8032c9e900d1938d49eb2e21e0ded7e4ea506c98b252610bdd2b609773e5a42a
https://s.threatbook.com/report/file/8032c9e900d1938d49eb2e21e0ded7e4ea506c98b252610bdd2b609773e5a42a
https://sandbox.qianxin.com/tq/report/toNewReport.do?rid=212587d1e1277eb3adbb0dd358be0265&sk=71714910
https://opentip.kaspersky.com/8032C9E900D1938D49EB2E21E0DED7E4EA506C98B252610BDD2B609773E5A42A/results?tab=upload

样本（发现提供）
提取码：52pj，解压码：无

1. https://wwanv.lanzoum.com/iDhkg4753lja?unzip=52pj

复制代码

莒县小哥

Error50X

莒县小哥 发表于 2026-9-7 17:33

你安全级别开的最高吗

莒县小哥

Error50X 发表于 2026-9-7 17:42
你安全级别开的最高吗

嗯

post88

WD MISS

117054487

XywCloud

#PureRAT
C2: 172.98.22.177:56001

fdsax

emsi双击

吃瓜群众第123位

趋势科技云端版 Scan miss

scottxzt

运行