SmartHawk

1.6

低危

1 个模型检测该样本为恶意！

重新分析

下载样本

5ece72c027344b18e54fbcb747c5afd4483f3d6a8da2914bb3f143306ee83b85

06aa3588e8601a79bbeef6f8b3aa0fd0.exe

分析耗时

71s

查杀引擎	查杀时间	查杀版本
McAfee	20200904	6.0.6.653
Alibaba	20190527	0.3.0.5
Baidu	20190318	1.0.0.2
Avast	20200904	18.4.3895.0
Tencent	20200904	1.0.0.1
Kingsoft	20200904	2013.8.14.323
CrowdStrike	20190702	1.0

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2017-09-30 06:27:29

Imports

Library MSVCP140D.dll:

• 0x41c098 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

• 0x41c09c ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ

• 0x41c0a0 ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z

• 0x41c0a4 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z

• 0x41c0a8 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ

• 0x41c0ac ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z

• 0x41c0b0 ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ

• 0x41c0b4 ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

• 0x41c0b8 ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ

• 0x41c0bc ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

• 0x41c0c0 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z

• 0x41c0c4 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

• 0x41c0c8 ?width@ios_base@std@@QAE_J_J@Z

• 0x41c0cc ?width@ios_base@std@@QBE_JXZ

• 0x41c0d0 ?flags@ios_base@std@@QBEHXZ

• 0x41c0d4 ?good@ios_base@std@@QBE_NXZ

• 0x41c0d8 ?uncaught_exception@std@@YA_NXZ

Library VCRUNTIME140D.dll:

• 0x41c114 __CxxFrameHandler3

• 0x41c118 __telemetry_main_return_trigger

• 0x41c11c __std_type_info_destroy_list

• 0x41c120 memset

• 0x41c124 _except_handler4_common

• 0x41c128 __vcrt_GetModuleFileNameW

• 0x41c12c __vcrt_GetModuleHandleW

• 0x41c130 __vcrt_LoadLibraryExW

• 0x41c134 __telemetry_main_invoke_trigger

Library ucrtbased.dll:

• 0x41c168 _seh_filter_dll

• 0x41c16c _initialize_onexit_table

• 0x41c170 _register_onexit_function

• 0x41c174 _execute_onexit_table

• 0x41c178 _crt_atexit

• 0x41c17c _crt_at_quick_exit

• 0x41c180 _controlfp_s

• 0x41c184 terminate

• 0x41c188 _wmakepath_s

• 0x41c18c _wsplitpath_s

• 0x41c190 wcscpy_s

• 0x41c194 __stdio_common_vsprintf_s

• 0x41c198 _initterm_e

• 0x41c19c _initterm

• 0x41c1a0 _get_initial_narrow_environment

• 0x41c1a4 _initialize_narrow_environment

• 0x41c1a8 _configure_narrow_argv

• 0x41c1ac __setusermatherr

• 0x41c1b0 _set_app_type

• 0x41c1b4 _seh_filter_exe

• 0x41c1b8 _CrtDbgReportW

• 0x41c1bc _CrtDbgReport

• 0x41c1c0 strlen

• 0x41c1c4 system

• 0x41c1c8 __p__commode

• 0x41c1cc _set_new_mode

• 0x41c1d0 _configthreadlocale

• 0x41c1d4 _register_thread_local_exe_atexit_callback

• 0x41c1d8 _c_exit

• 0x41c1dc _cexit

• 0x41c1e0 _exit

• 0x41c1e4 __p___argc

• 0x41c1e8 exit

• 0x41c1ec _set_fmode

• 0x41c1f0 __p___argv

Library KERNEL32.dll:

• 0x41c000 RaiseException

• 0x41c004 MultiByteToWideChar

• 0x41c008 WideCharToMultiByte

• 0x41c00c UnhandledExceptionFilter

• 0x41c010 SetUnhandledExceptionFilter

• 0x41c014 GetCurrentProcess

• 0x41c018 TerminateProcess

• 0x41c01c IsProcessorFeaturePresent

• 0x41c020 QueryPerformanceCounter

• 0x41c024 GetCurrentProcessId

• 0x41c028 GetCurrentThreadId

• 0x41c02c GetSystemTimeAsFileTime

• 0x41c030 InitializeSListHead

• 0x41c034 GetStartupInfoW

• 0x41c038 GetModuleHandleW

• 0x41c03c GetLastError

• 0x41c040 HeapAlloc

• 0x41c044 GetProcAddress

• 0x41c048 FreeLibrary

• 0x41c04c VirtualQuery

• 0x41c050 GetProcessHeap

• 0x41c054 HeapFree

• 0x41c058 IsDebuggerPresent

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.

section	.textbss
section	.gfids
section	.00cfg