2.2
中危
该样本未表现出任何异常！
重新分析
更多

02f13551439e94b87d2c046eabc2e8fb310d8020083f5ed44d52edba47257603

02f13551439e94b87d2c046eabc2e8fb310d8020083f5ed44d52edba47257603.exe

分析耗时

154s

最近分析

392天前

文件大小

18.6KB
静态报毒 动态报毒 UNKNOWN
鹰眼引擎
DACN 0.14
FACILE 1.00
IMCLNet 0.61
MFGraph 0.00
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
检查进程是否被调试器调试 (2 个事件)
Time & API Arguments Status Return Repeated
1727545286.547125
IsDebuggerPresent
failed 0 0
1727545287.0305
IsDebuggerPresent
failed 0 0
可执行文件包含未知的 PE 段名称，可能指示打包器（可能是误报） (2 个事件)
section RjcHalKw
section qmpJQplM
行为判定
动态指标
分配可读-可写-可执行内存（通常用于自解压） (2 个事件)
Time & API Arguments Status Return Repeated
1727545286.656125
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00401000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 1260
success 0 0
1727545287.1085
NtProtectVirtualMemory
process_handle: 0xffffffff
base_address: 0x00401000
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_identifier: 2004
success 0 0
在文件系统上创建可执行文件 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\psie.exe
投放一个二进制文件并执行它 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\psie.exe
将可执行文件投放到用户的 AppData 文件夹 (1 个事件)
file C:\Users\Administrator\AppData\Local\Temp\psie.exe
一个进程创建了一个隐藏窗口 (1 个事件)
Time & API Arguments Status Return Repeated
1727545286.844125
ShellExecuteExW
filepath: C:\Users\Administrator\AppData\Local\Temp\psie.exe
filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\psie.exe
parameters:
show_type: 0
success 1 0
该二进制文件可能包含加密或压缩数据，表明使用了打包工具 (2 个事件)
section {'name': 'qmpJQplM', 'virtual_address': '0x00008000', 'virtual_size': '0x00002000', 'size_of_data': '0x00001400', 'entropy': 7.536265256010841} entropy 7.536265256010841 description 发现高熵的节
entropy 0.5263157894736842 description 此PE文件的整体熵值较高
网络通信
与未执行 DNS 查询的主机进行通信 (4 个事件)
host 193.239.71.113
host 74.125.135.26
host 172.253.113.27
host 114.114.114.114
连接到不再响应请求的 IP 地址（合法服务通常会保持运行） (1 个事件)
dead_host 162.241.85.94:443
可视化分析
二进制图像
数据导入图像 288x288
数据导入图像 224x224
数据导入图像 192x192
数据导入图像 160x160
数据导入图像 128x128
数据导入图像 96x96
数据导入图像 64x64
数据导入图像 32x32
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2013-11-13 03:03:37

PE Imphash

1d583e55dd90fae937cd048052dc060d

Sections

Name Virtual Address Virtual Size Size of Raw Data Entropy
RjcHalKw 0x00001000 0x00007000 0x00000000 0.0
qmpJQplM 0x00008000 0x00002000 0x00001400 7.536265256010841
.rsrc 0x0000a000 0x00002000 0x00001200 5.7681289647666105

Resources

Name Offset Size Language Sub-language File type
RT_ICON 0x0000a0ec 0x00000ea8 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_GROUP_ICON 0x0000af98 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US None
RT_MANIFEST 0x0000afb0 0x0000015a LANG_ENGLISH SUBLANG_ENGLISH_US None

Imports

Library GDI32.dll:
• 0x40b15c GetStockObject
Library KERNEL32.DLL:
• 0x40b164 LoadLibraryA
• 0x40b168 ExitProcess
• 0x40b16c GetProcAddress
• 0x40b170 VirtualProtect
Library USER32.dll:
• 0x40b178 LoadIconA
L!This program cannot be run in DOS mode.
R:)RSR
RRichR
RjcHalKw
qmpJQplM
/?gQ!d3#
Vj#hw}
hLPhKd
Q)-I.9.
,U2m_,h
m"!OX-
@hO0E O
0%F]WE
PAW6PlWW
cQWURVpt*Lw
(u[_^]5
#j\Ph3
-4 jEh)G5l
E?pD_
v@VWAAf9
@#mH;Eu
s"'XEq3
jNbl:6CV
V85:a3Tj4S+mz#[
]?6(h9
y^Bkn"/
XOHx0
lWR=k".;{#gfb:" **Ciq(dQbfv
OQ;- m8b\e
=YX/-|}
VD&4H[
*GU:*_i6
>m%akSmNR='bB#{
`~a,"i.(l`-
p%^}ng
QRN/Db,bl=
"|#`fG
x?\cq;U
Cx0Y4|]t
Xdb')|4zbp
(Z {ap?i;(|y;7xcn
tvN4}[A
+[|fWW
z$KYLA
"wOx4N
8.^YYTG4K%PzrI
[;L_Tg=T
5kfy;l)%
N;wyxW
\87,H}awDg
q%O[?Z],
TgS/$B
av<~D`O7Q;
|0KcBR
X.w;pO
M7RD-b&.a\
$ WPb,OW9?
[C/`OD|~QS$a
QHa=Uig?
]h6ll&`te
O9O~ %k
7,9'>oa+_
+q> jamCC:,?.9n ;
JoL!uIe'O"&>c=s
{m/} 4\
~wNc$;
A/c=;]./-N
9\h[k.(
%#S"@C6ghk;?E:5
EW//]SQ
GYK Iu
A[Q>+ 5d!j0O
L/4]7p
\Ne4M:,
KWk"apoPw
Textstmw but)n
!]splay)
\P`8R%N
NHI&OKLV']XT
Cb5)WPR
>1+`P
O#^V{U[
(construc<
>?-E,%*T5(G2
,O@RR@
Y[0;`-
N+Z4.P7
A(&_1<U=
v)r'U!l
R/t6C4
TA--/36BAG;
QU%$AEA6
Heapnoc{o
Moduv{leHand
ReQS! Poin[m*r
t]|StCkObjec
MagwYst
Mch"Upd^[Wdow
LovCursorW
dvTrsl
9ExAXk]g^C3/
43,$C(>AKeyb.rd
z[NngAPE
}Y8dB`.Ha
'6nSOsrs@
OETHLdWV6-e|`.'K-k
XPTPSWXaD$j
,,,,,,,,
A988882222
WJJIIi888448242
dPONJJJJIl988484442
hyeeccc^^PPONJJJIp989464442
1eeeec^^^cRNOJJJIIK989946442
qeeeec^cYPPNOOJJIII888464Z[
ygeece^^^PPOOKJJIIp
geeec^c^PPd
hgeeecy
0i9;::444;
Fp99;8:4444
99;94:444
999:;46:3
rqggccc^YWP
!II9;;::464
,&%%Rqegcd^YY*
III9<9;;:6V\
,(**>cccY^J
,555=cdcY
,>>>>h^*
,??BEY
Oll99<::846\
,BEEE"
KOKUpA<;9::66\
,GGGGaE
>OOKKK<<;;;:6:V
,HHXXX
5WUOKKKA<<<<;;6::
,____a#
&PUKKKAA[<A<;;;:33
,``bbbM#
YOOA::::<<jj{
,}}}}+#
--.,,,,,,,,,,,,,,,,,,,,,,,,,,,
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
</assembly>
GDI32.dll
KERNEL32.DLL
USER32.dll
GetStockObject
ExitProcess
GetProcAddress
LoadLibraryA
VirtualProtect
LoadIconA
z`szt{clekfiu|z~wsv|p||
C:\Documents and Settings\kftwo-shen\
\Payroll.exe
C:\o7H8pqSa.exe
C:\JtSrf8bR.exe
C:\Y_TFbwuy.exe
C:\MvfLn1C8.exe
C:\Ye4ASZoo.exe
C:\G4bL27xj.exe
C:\pZnSxPdh.exe
C:\9E7bDVw9.exe
C:\yFdiSYi3.exe
C:\A_4SwX7s.exe
C:\xUFmWmvy.exe
C:\UbUhnobY.exe
C:\3QaWrIDq.exe
C:\xrzSH1Rs.exe
C:\rDExxZ2a.exe
C:\Ji8y6MM0.exe
C:\n8Q812EZ.exe
C:\Nd8Dzg16.exe
C:\sO9SNsCl.exe
C:\5EhAYwpw.exe
C:\f9e6705eb0906a594a8130f2ff01289f4c3e285fc3959318bce671e6455eb053
C:\91e75b25d874ac5bd71caf9b3b99b6f2e78ff13675f28a654eb79bb0d6ece4da
C:\7CiiZkI7.exe
C:\Jyvr3G_4.exe
C:\v5o2wujZ.exe
C:\WX4aQxsT.exe
C:\m2t_WasS.exe
C:\RjFPJjUJ.exe
C:\60eswPsN.exe
C:\cab4056a87bc7c6daeeb861699f944d4062d47e97331722356524b1a47fe6a6f
C:\499be9123663dc64e030472942605baf6b8e46b1497481ad32d13dd0df2fa29c
C:\Users\Petra\AppData\Local\Temp\tmp0h6cvqxt.pe32
c:\task\873A0A43CC6D6B346BA2910A6DB1749D.exe
c:\task\F636381C6A234ED96289162E8EDA4778.exe
c:\task\049AEB9E91728D1DCC4A9F3270038D09.exe
C:\Users\admin\Downloads\sample.exe
C:\Users\admin\Downloads\sample.exe
C:\c8efa95c5a726087c64ebca9c29026c5388072e8c63952c825e2c846407dda13
C:\ba0c09d6ef657db62cc3513bd12922b3b556fa779c06a5085d1b1b8ff77f4eea
C:\Users\Petra\AppData\Local\Temp\psie.pe32
C:\1d0ad0060bd33bb4248e2165a08558a0be9202fc4a019591994986ef266fb867
C:\9b7273d107569ebb417703a9596beb965f4f76695d1e58e0899c6683f0191958
C:\57f95f1c423529f7b92a078d480a1b2b822316a522f7b53a5b4839103b7b589f
C:\Users\Petra\AppData\Local\Temp\psie.pe32
C:\4552f93e97fb8cb954f6c90d2513e97ded4bd6edead69ddf58c9e0838f347d52
C:\Users\admin\Downloads\factura.exe
C:\Users\admin\Downloads\factura.exe
C:\Users\admin\Downloads\invoice.exe
C:\Xmx743DS.exe
C:\2cc341d64dab576df338fccd7ab162586dcd2e608848320e92302bacbd28e9fe
C:\767e778b1c284d6c4af0213cd5b7ccb9fbf703ae090fcad26b984c47d30b464f
C:\8TJjCBoz.exe
C:\03b52694560396d60145cd8b6a98edce146e48112baba629b40200c29bc8eab7
C:\8521e1b9c52182a12b8efad413f8e2ca900d19df912b330509b8d4c9c653a4d4
C:\Users\admin\Downloads\psie.exe
C:\046b30925a6ee0a9880491bde688e656710f478a04f47046ec920c2134e89a8c
C:\7a5643d91bfbc7d199dee516ee34d913a5c8c315d5be43c1a198ee3554c13419
C:\Users\Joe Cage\Desktop\SDTMwrLLB8.exe
C:\Users\admin\Downloads\35cfcf3e2325c989bd92655a9b432e44.virus.exe
C:\07da5e219654e3cc2f83135e7845a3b892b8ea93d427f6a76ee4e2957f82cf5f
C:\Users\admin\Downloads\psie.exe
C:\b54ab2b40645357b31ef614ef8b63650307265ea3a3415a8bb3cab89db0c8568
C:\Users\admin\Downloads\psie.exe
C:\fac5ed05ddccdf53436a1a933a03f2e3f4b2cbd75d0f45e41236e3e1a2861add
C:\55693a6912db915d40cf43d23d0bd86b96cc2f33867f3182e779bcdebc1c5cf8
C:\Users\RA491~1.VUL\AppData\Local\Temp\8adecfe81645063fe6fc434c5bef435e.exe
C:\0e0a78adcd0c9c7880b6e54d82476e90321a8d936605937ff01923eaf87e907a
C:\Users\admin\Downloads\psie.exe
C:\6fe12a27afbff9c89864c8978aa83f8e21fd32559c631b4669625245f2058499
C:\441f9cdc9517632f085926c75cb7964939c8c1aa3dc9f5f560cf5da46fb1efd8
C:\Users\admin\Downloads\psie.exe
C:\04a620be39966030e4d4d61e5c6ddfcc2f3869d130323228294b471846aa9c0d
C:\0f64cff36b22dccafa69cee240451968c57c469d818b6923d5f6556bef032149
C:\Users\admin\Downloads\psie.exe
C:\9864c2b28a551a41161e0e33cf1f1c83eb2f22090005f02868ef1ddcc5d9b188
C:\315bc7cfad2385381fe46afd2858b7924d05a40fc8b3d19909494a7439b55b11
C:\ad59c0738053cdcbe417704b9e05567045adb2c8c53db3a363d8b0260079ab51
C:\Users\admin\Downloads\psie.exe
C:\0815ea7d5d05027141907d88350de7a6010441b24b9cbc0ca43e6a21b3665d77
C:\Users\admin\Downloads\psie.exe
C:\56b995f247c0d76314bef44f0aaf1c07ccb445a135db06f3188e86e1cbf655bc
C:\Users\admin\Downloads\psie.exe
C:\bdca15df90ec376e5467bddffd90ae35edf7253db145b86a2fed68e15dd97a29
C:\Users\admin\Downloads\psie.exe
C:\09c54120a8b9a422cd6162f488507829ef209ccdea539e3cbd1da6b12afe8176
C:\Users\admin\Downloads\psie.exe
C:\d36faf0deec3ae192fe495d07ee5c6b548f234bf45963bd5d677961929776cf4
C:\ecce3a3e079ab8c3ab45b96fbb8434712ed31fb52c87e144d39c9ba38a8844ed
C:\5be78fcb027232572c2b396bae6ff8ff26bac1b8e43026ad2b2fbdee7469d9e4
C:\Users\admin\Downloads\psie.exe
C:\52f86577d07d0c6bd3faf1201e5cf024d887fae458ea842393bdeae852666e9d
C:\Users\RA491~1.VUL\AppData\Local\Temp\8adecfe81645063fe6fc434c5bef435e.exe
C:\Users\admin\Downloads\psie.exe

Process Tree

02f13551439e94b87d2c046eabc2e8fb310d8020083f5ed44d52edba47257603.exe, PID: 1260, Parent PID: 2736

default registry file network process services synchronisation iexplore office pdf

psie.exe, PID: 2004, Parent PID: 1260

default registry file network process services synchronisation iexplore office pdf

TCP

Source Source Port Destination Destination Port
74.125.135.26 25 192.168.56.101 49218
172.253.113.27 25 192.168.56.101 49217
193.239.71.113 25 192.168.56.101 49213
192.168.56.101 49164 162.241.85.94 abrobotics.com 443
192.168.56.101 49165 162.241.85.94 abrobotics.com 443
192.168.56.101 49166 162.241.85.94 abrobotics.com 443
192.168.56.101 49168 162.241.85.94 abrobotics.com 443
192.168.56.101 49169 162.241.85.94 abrobotics.com 443
192.168.56.101 49170 162.241.85.94 abrobotics.com 443
192.168.56.101 49172 162.241.85.94 abrobotics.com 443
192.168.56.101 49173 162.241.85.94 abrobotics.com 443
192.168.56.101 49174 162.241.85.94 abrobotics.com 443
192.168.56.101 49176 162.241.85.94 abrobotics.com 443
192.168.56.101 49177 162.241.85.94 abrobotics.com 443
192.168.56.101 49178 162.241.85.94 abrobotics.com 443
192.168.56.101 49180 162.241.85.94 abrobotics.com 443
192.168.56.101 49181 162.241.85.94 abrobotics.com 443
192.168.56.101 49182 162.241.85.94 abrobotics.com 443
192.168.56.101 49184 162.241.85.94 abrobotics.com 443
192.168.56.101 49185 162.241.85.94 abrobotics.com 443
192.168.56.101 49186 162.241.85.94 abrobotics.com 443
192.168.56.101 49188 162.241.85.94 abrobotics.com 443
192.168.56.101 49189 162.241.85.94 abrobotics.com 443
192.168.56.101 49190 162.241.85.94 abrobotics.com 443
192.168.56.101 49192 162.241.85.94 abrobotics.com 443
192.168.56.101 49193 162.241.85.94 abrobotics.com 443
192.168.56.101 49194 162.241.85.94 abrobotics.com 443
192.168.56.101 49196 162.241.85.94 abrobotics.com 443
192.168.56.101 49197 162.241.85.94 abrobotics.com 443
192.168.56.101 49198 162.241.85.94 abrobotics.com 443
192.168.56.101 49200 162.241.85.94 abrobotics.com 443
192.168.56.101 49201 162.241.85.94 abrobotics.com 443
192.168.56.101 49202 162.241.85.94 abrobotics.com 443
192.168.56.101 49204 162.241.85.94 abrobotics.com 443
192.168.56.101 49205 162.241.85.94 abrobotics.com 443
192.168.56.101 49206 162.241.85.94 abrobotics.com 443
192.168.56.101 49208 162.241.85.94 abrobotics.com 443
192.168.56.101 49209 162.241.85.94 abrobotics.com 443
192.168.56.101 49210 162.241.85.94 abrobotics.com 443
192.168.56.101 49212 162.241.85.94 abrobotics.com 443
192.168.56.101 49213 162.241.85.94 abrobotics.com 443
192.168.56.101 49214 162.241.85.94 abrobotics.com 443
192.168.56.101 49216 162.241.85.94 abrobotics.com 443
192.168.56.101 49217 162.241.85.94 abrobotics.com 443
192.168.56.101 49218 162.241.85.94 abrobotics.com 443
192.168.56.101 49220 162.241.85.94 abrobotics.com 443
192.168.56.101 49221 162.241.85.94 abrobotics.com 443
192.168.56.101 49222 162.241.85.94 abrobotics.com 443
192.168.56.101 49224 162.241.85.94 abrobotics.com 443
192.168.56.101 49225 162.241.85.94 abrobotics.com 443
192.168.56.101 49226 162.241.85.94 abrobotics.com 443
192.168.56.101 49228 162.241.85.94 abrobotics.com 443
192.168.56.101 49229 162.241.85.94 abrobotics.com 443
192.168.56.101 49230 162.241.85.94 abrobotics.com 443
192.168.56.101 49232 162.241.85.94 abrobotics.com 443
192.168.56.101 49233 162.241.85.94 abrobotics.com 443
192.168.56.101 49234 162.241.85.94 abrobotics.com 443
192.168.56.101 49236 162.241.85.94 abrobotics.com 443
192.168.56.101 49237 162.241.85.94 abrobotics.com 443
192.168.56.101 49238 162.241.85.94 abrobotics.com 443
192.168.56.101 49240 162.241.85.94 abrobotics.com 443
192.168.56.101 49241 162.241.85.94 abrobotics.com 443
192.168.56.101 49242 162.241.85.94 abrobotics.com 443
192.168.56.101 49244 162.241.85.94 abrobotics.com 443
192.168.56.101 49245 162.241.85.94 abrobotics.com 443
192.168.56.101 49246 162.241.85.94 abrobotics.com 443
192.168.56.101 49248 162.241.85.94 abrobotics.com 443
192.168.56.101 49249 162.241.85.94 abrobotics.com 443
192.168.56.101 49250 162.241.85.94 abrobotics.com 443
192.168.56.101 49253 162.241.85.94 abrobotics.com 443
192.168.56.101 49254 162.241.85.94 abrobotics.com 443
192.168.56.101 49255 162.241.85.94 abrobotics.com 443
192.168.56.101 49257 162.241.85.94 abrobotics.com 443
192.168.56.101 49258 162.241.85.94 abrobotics.com 443
192.168.56.101 49259 162.241.85.94 abrobotics.com 443
192.168.56.101 49261 162.241.85.94 abrobotics.com 443
192.168.56.101 49262 162.241.85.94 abrobotics.com 443
192.168.56.101 49263 162.241.85.94 abrobotics.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 53179 224.0.0.252 5355
192.168.56.101 49642 224.0.0.252 5355
192.168.56.101 137 192.168.56.255 137
192.168.56.101 61714 114.114.114.114 53
192.168.56.101 56933 114.114.114.114 53
192.168.56.101 138 192.168.56.255 138
192.168.56.101 58485 114.114.114.114 53
192.168.56.101 57665 114.114.114.114 53
192.168.56.101 51758 114.114.114.114 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Name b95eeb39b9ced654_psie.exe
Filepath C:\Users\Administrator\AppData\Local\Temp\psie.exe
Size 18.8KB
Processes 1260 (02f13551439e94b87d2c046eabc2e8fb310d8020083f5ed44d52edba47257603.exe)
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f7247bb19503a20a861c981f23cf753f
SHA1 e2c5555d7973ff7cbbfb9f981be98ef706ae17ee
SHA256 b95eeb39b9ced654932e2b9b2b59dce8631dc89f2d718f661d4b71e172778c55
CRC32 CF75211E
ssdeep None
Yara None matched
VirusTotal Search for analysis
Sorry! No dropped buffers.