2.0
低危
该样本未表现出任何异常！
重新分析
更多

170e39bd12879a481a87fcc2b891f3ebce9fd5fa760d5735285d285900277c34

091c94bf6f95e3652ee8e2138efdad9c.exe

分析耗时

18s

最近分析

文件大小

2.3MB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619134515.686372
IsDebuggerPresent
failed 0 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)
section 0
section 1
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619134516.280372
__exception__
stacktrace: 

                
            
            
            

        
    
        
            
                registers.esp:
                13564808
                

            
                registers.edi:
                6820
                

            
                registers.eax:
                1752095817
                

            
                registers.ebp:
                13565792
                

            
                registers.edx:
                77
                

            
                registers.ebx:
                4194304
                

            
                registers.esi:
                2061693
                

            
                registers.ecx:
                70672
                

            
        
    
        
            
                exception.instruction_r:
                90 68 dc f3 5d 8d e8 da 74 fe ff 29 ae d6 9a de
                

            
                exception.instruction:
                nop
                

            
                exception.module:
                091c94bf6f95e3652ee8e2138efdad9c.exe
                

            
                exception.exception_code:
                0x80000004
                

            
                exception.offset:
                2952564
                

            
                exception.address:
                0x6d0d74
                

            
        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    

    

    








      

    


    

      

        行为判定
        
        
      

      

        



    

      
      动态指标
    

    

    
    

    

    

    
        
            

                Allocates read-write-execute memory (usually to unpack itself)
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        
                            
                                

                                    Time & API
                                    Arguments
                                    Status
                                    Return
                                    Repeated
                                

                            
                        
                        

                            

    1619134515.717372

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    3040
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    2056192
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x004b0000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
                    
                        
                        

                            

    1619134515.717372

    NtProtectVirtualMemory
    
        

        
            
        
    


    
        
            process_identifier:
            
                
                    3040
                
            
            
            

        
    
        
            stack_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            stack_pivoted:
            
                
                    0
                
            
            
            

        
    
        
            heap_dep_bypass:
            
                
                    0
                
            
            
            

        
    
        
            length:
            
                
                    614400
                
            
            
            

        
    
        
            protection:
            
                
                    64
                
            
            
                (PAGE_EXECUTE_READWRITE)
            
            

        
    
        
            process_handle:
            
                
                    0xffffffff
                
            
            
            

        
    
        
            base_address:
            
                
                    0x00401000
                
            
            
            

        
    


    
        success
    

0

    
        0
    


                        

                    
                
            

        

    

    
        
            

                The binary likely contains encrypted or compressed data indicative of a packer
                
                    
                        (2 个事件)
                    
                
            

        

        

            

                
                    
                        

                            
                                
                                    entropy
                                    7.993950463764138
                                
                            
                                
                                    section
                                    {'size_of_data': '0x00245000', 'virtual_address': '0x002a6000', 'entropy': 7.993950463764138, 'name': '1', 'virtual_size': '0x00244fc0'}
                                
                            
                                
                            
                                
                                    description
                                    A section with a high entropy has been found
                                
                            
                        

                    
                
                    
                        

                            
                                
                                    entropy
                                    0.9995698924731182
                                
                            
                                
                            
                                
                                    description
                                    Overall entropy of this PE file is high
                                
                            
                        

                    
                
            

        

    

    







        


      


    


    

      

        可视化分析
        
        
      

      

        


    

      
      二进制图像
    

    
        

            

                
                

                    暂无二进制图像
                    该样本未生成二进制可视化图像
                

            

        

    





        

    

      
      运行截图
    

    
        

            

                
                

                    暂无运行截图
                    该样本运行过程中未生成截图
                

            

        

    





      


    


  



    

    

        





    

        

            
👋 欢迎使用 ChatHawk

            
我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

            

                
🔍 主要威胁分析

                
⚡ 行为特征

                
🛡️ 防护建议

                
🔧 技术手段

                
🎯 检测方法

            

        

    

    

        

            
🤖

            

                

                

                

            

        

    

    

        
        
    








    

    

        

    
    

        

            
                

    
        
            

                
 PE Compile Time

                
2018-02-11 09:38:17

            

            

        
        
        
        
        
        
        

        

        
            

                
Imports

                

                    
                        

                            
Library WSOCK32.dll:

                            
                                
• 0x6b5000 WSACleanup

                            
                        

                    
                        

                            
Library WINMM.dll:

                            
                                
                            
                        

                    
                        

                            
Library VERSION.dll:

                            
                                
• 0x6b5010 VerQueryValueA

                            
                        

                    
                        

                            
Library COMCTL32.dll:

                            
                                
• 0x6b5018 ImageList_Create

                            
                        

                    
                        

                            
Library PSAPI.DLL:

                            
                                
• 0x6b5020 GetModuleBaseNameA

                            
                        

                    
                        

                            
Library KERNEL32.dll:

                            
                                
• 0x6b5028 GetVersionExW

                            
                        

                    
                        

                            
Library USER32.dll:

                            
                                
• 0x6b5030 GetMenuStringA

                            
                        

                    
                        

                            
Library GDI32.dll:

                            
                                
• 0x6b5038 GetPixel

                            
                        

                    
                        

                            
Library COMDLG32.dll:

                            
                                
                            
                        

                    
                        

                            
Library ADVAPI32.dll:

                            
                                
• 0x6b5048 RegDeleteKeyA

                            
                        

                    
                        

                            
Library SHELL32.dll:

                            
                                
• 0x6b5050 DragQueryPoint

                            
                        

                    
                        

                            
Library ole32.dll:

                            
                                
• 0x6b5058 OleInitialize

                            
                        

                    
                        

                            
Library OLEAUT32.dll:

                            
                                
• 0x6b5060 SafeArrayGetLBound

                            
                        

                    
                        

                            
Library WTSAPI32.dll:

                            
                                
• 0x6b5068 WTSSendMessageW

                            
                        

                    
                        

                            
Library KERNEL32.dll:

                            
                                
• 0x6b5070 GetCurrentProcess

                            
                        

                    
                        

                            
Library USER32.dll:

                            
                                
• 0x6b5078 CharUpperBuffW

                            
                        

                    
                        

                            
Library ADVAPI32.dll:

                            
                                
• 0x6b5080 RegQueryValueExA

                            
                        

                    
                        

                            
Library KERNEL32.dll:

                            
                                
• 0x6b5088 LocalAlloc

                            
                                
• 0x6b508c GetCurrentProcess

                            
                                
• 0x6b5090 GetCurrentThread

                            
                                
• 0x6b5094 LocalFree

                            
                                
• 0x6b5098 GetModuleFileNameW

                            
                                
                            
                                
                            
                                
                            
                                
• 0x6b50a8 Sleep

                            
                                
• 0x6b50ac ExitProcess

                            
                                
• 0x6b50b0 GetLastError

                            
                                
• 0x6b50b4 FreeLibrary

                            
                                
• 0x6b50b8 LoadLibraryA

                            
                                
• 0x6b50bc GetModuleHandleA

                            
                                
• 0x6b50c0 GetProcAddress

                            
                        

                    
                        

                            
Library ADVAPI32.dll:

                            
                                
• 0x6b50c8 OpenSCManagerW

                            
                                
                            
                                
• 0x6b50d0 OpenServiceW

                            
                                
• 0x6b50d4 QueryServiceConfigW

                            
                                
• 0x6b50d8 CloseServiceHandle

                            
                        

                    
                

            

            

        

        
    



            
        

        

            

    

        
    



        

    



    

    
    

        

    
    

        

    
Hosts

    
        
No hosts contacted.

    




        
        





    
TCP

    
        
No TCP connections recorded.

    





        





    
UDP

    
        

            

                

                    

                        Source
                        Source Port
                        Destination
                        Destination Port
                    

                    
                        

                            192.168.56.101
                            50534
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            51963
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            56539
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            65004
                            114.114.114.114 
                            53
                        

                    
                        

                            192.168.56.101
                            137
                            192.168.56.255 
                            137
                        

                    
                        

                            192.168.56.101
                            138
                            192.168.56.255 
                            138
                        

                    
                        

                            192.168.56.101
                            49235
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            56804
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            60123
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            62191
                            224.0.0.252 
                            5355
                        

                    
                        

                            192.168.56.101
                            1900
                            239.255.255.250 
                            1900
                        

                    
                        

                            192.168.56.101
                            50535
                            239.255.255.250 
                            3702
                        

                    
                        

                            192.168.56.101
                            50537
                            239.255.255.250 
                            3702
                        

                    
                        

                            192.168.56.101
                            56540
                            239.255.255.250 
                            3702
                        

                    
                        

                            192.168.56.101
                            56807
                            239.255.255.250 
                            1900
                        

                    
                        

                            192.168.56.101
                            58707
                            239.255.255.250 
                            3702
                        

                    
                

            

            

        

    




        



HTTP & HTTPS Requests



No HTTP requests performed.




        
ICMP traffic



No ICMP traffic performed.



        
IRC traffic



No IRC requests performed.



        
Suricata Alerts


    
No Suricata Alerts




Suricata TLS


    
No Suricata TLS




        
Snort Alerts


    
No Snort Alerts




    




    

    

        
    
Sorry! No dropped files.



    

    

        
    
Sorry! No dropped buffers.