SmartHawk

3.6

中危

20 个模型检测该样本为恶意！

重新分析

下载样本

f55f45f8b3d853534e87c21ee9c122b305b9b9aa5cd9ace06514d15d21d4c8bf

12882928722e9c24584636601dd40389.exe

分析耗时

74s

最近分析

文件大小

11.4MB

静态报毒动态报毒 AGENERIC AOUP ARTEMIS AZNHI BSCOPE MALICIOUS VKONTAKTEDJ 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!12882928722E	20190805	6.0.6.653
Alibaba	Downloader:Win32/Generic.580694c1	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Trojan-gen	20190805	18.4.3895.0
Tencent		20190805	1.0.0.1
Kingsoft		20190805	2013.8.14.323
CrowdStrike		20190212	1.0

This executable is signed

This executable has a PDB path (1 个事件)

pdb_path

C:\Users\User\JOB\chistilka\cleaner-packer\Packer\Release\Packer.pdb

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

BLDAT

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:1409325940&cup2hreq=f57ab4c7531e2a407f0bad77eafb383b85acc7ed7425f0e6cb72cf6df54010e1

Performs some HTTP requests (3 个事件)

request	HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request	HEAD http://r1---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.99&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1620107538&mv=m&mvi=1&pl=23&shardbypass=yes
request	POST https://update.googleapis.com/service/update2?cup2key=10:1409325940&cup2hreq=f57ab4c7531e2a407f0bad77eafb383b85acc7ed7425f0e6cb72cf6df54010e1

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:1409325940&cup2hreq=f57ab4c7531e2a407f0bad77eafb383b85acc7ed7425f0e6cb72cf6df54010e1

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.998099403483617

section

{'size_of_data': '0x00b1b200', 'virtual_address': '0x00048000', 'entropy': 7.998099403483617, 'name': '.rsrc', 'virtual_size': '0x00b1b030'}

description

A section with a high entropy has been found

entropy

0.9755940636527408

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 个事件)

McAfee	Artemis!12882928722E
Alibaba	Downloader:Win32/Generic.580694c1
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
APEX	Malicious
Kaspersky	not-a-virus:HEUR:Downloader.Win32.Generic
Avast	Win32:Trojan-gen
Emsisoft	Application.AdLoad (A)
F-Secure	Trojan.TR/Dldr.Agent.aznhi
DrWeb	Program.VKontakteDJ.79
McAfee-GW-Edition	Artemis!PUP
Jiangmin	Downloader.Generic.aoup
Webroot	W32.Adware.Gen
Avira	TR/Dldr.Agent.aznhi
Antiy-AVL	RiskWare[Downloader]/Win32.AGeneric
ZoneAlarm	not-a-virus:HEUR:Downloader.Win32.Generic
AhnLab-V3	Malware/Gen.Generic.C3355309
VBA32	BScope.Downloader.Agent
AVG	Win32:Trojan-gen
Qihoo-360	Win32/Virus.Downloader.c27

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2019-07-24 22:06:38

Imports

Library KERNEL32.dll:

• 0x438000 GetModuleFileNameW

• 0x438004 OutputDebugStringA

• 0x438008 OutputDebugStringW

• 0x43800c SizeofResource

• 0x438010 GetTempPathW

• 0x438014 GetLastError

• 0x438018 LockResource

• 0x43801c DeleteFileW

• 0x438020 LoadResource

• 0x438024 FindResourceW

• 0x438028 GetTempFileNameW

• 0x43802c TerminateProcess

• 0x438030 QueryPerformanceCounter

• 0x438034 GetCurrentProcessId

• 0x438038 GetCurrentThreadId

• 0x43803c GetSystemTimeAsFileTime

• 0x438040 IsDebuggerPresent

• 0x438044 GetStartupInfoW

• 0x438048 SetUnhandledExceptionFilter

• 0x43804c WideCharToMultiByte

• 0x438050 CreateProcessW

• 0x438054 UnhandledExceptionFilter

• 0x438058 IsProcessorFeaturePresent

• 0x43805c GetProcAddress

• 0x438060 GetModuleHandleW

• 0x438064 CreateEventW

• 0x438068 WaitForSingleObjectEx

• 0x43806c ResetEvent

• 0x438070 SetEvent

• 0x438074 DeleteCriticalSection

• 0x438078 InitializeCriticalSectionAndSpinCount

• 0x43807c LeaveCriticalSection

• 0x438080 EnterCriticalSection

• 0x438084 CloseHandle

• 0x438088 InitializeSListHead

• 0x43808c GetCurrentProcess

Library MSVCP140.dll:

• 0x438094 ?uncaught_exceptions@std@@YAHXZ

• 0x438098 ?_Xbad_alloc@std@@YAXXZ

• 0x43809c ?_Xbad_function_call@std@@YAXXZ

• 0x4380a0 ?always_noconv@codecvt_base@std@@QBE_NXZ

• 0x4380a4 ?set_new_handler@std@@YAP6AXXZP6AXXZ@Z

• 0x4380a8 ?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x4380ac ?id@?$ctype@D@std@@2V0locale@2@A

• 0x4380b0 ??0_Locinfo@std@@QAE@PBD@Z

• 0x4380b4 ??1_Locinfo@std@@QAE@XZ

• 0x4380b8 ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ

• 0x4380bc ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z

• 0x4380c0 ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4380c4 ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ

• 0x4380c8 ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z

• 0x4380cc ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z

• 0x4380d0 ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4380d4 ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z

• 0x4380d8 ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z

• 0x4380dc ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ

• 0x4380e0 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4380e4 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ

• 0x4380e8 ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z

• 0x4380ec ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z

• 0x4380f0 ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

• 0x4380f4 ?_Incref@facet@locale@std@@UAEXXZ

• 0x4380f8 ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ

• 0x4380fc ??0facet@locale@std@@IAE@I@Z

• 0x438100 ??1facet@locale@std@@MAE@XZ

• 0x438104 ?tolower@?$ctype@D@std@@QBEDD@Z

• 0x438108 ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z

• 0x43810c _Strcoll

• 0x438110 ?id@?$collate@D@std@@2V0locale@2@A

• 0x438114 ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z

• 0x438118 ?_Xinvalid_argument@std@@YAXPBD@Z

• 0x43811c ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z

• 0x438120 _Strxfrm

• 0x438124 ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ

• 0x438128 ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ

• 0x43812c ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ

• 0x438130 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

• 0x438134 ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

• 0x438138 ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z

• 0x43813c ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

• 0x438140 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ

• 0x438144 ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ

• 0x438148 ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ

• 0x43814c ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

• 0x438150 ?_Xlength_error@std@@YAXPBD@Z

• 0x438154 ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z

• 0x438158 ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

• 0x43815c ?_Xout_of_range@std@@YAXPBD@Z

• 0x438160 ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ

• 0x438164 ??0_Lockit@std@@QAE@H@Z

• 0x438168 ??1_Lockit@std@@QAE@XZ

• 0x43816c ??Bid@locale@std@@QAEIXZ

Library VCRUNTIME140.dll:

• 0x438184 memcpy

• 0x438188 _CxxThrowException

• 0x43818c __std_type_info_name

• 0x438190 _purecall

• 0x438194 memset

• 0x438198 __std_exception_copy

• 0x43819c __std_exception_destroy

• 0x4381a0 __CxxFrameHandler3

• 0x4381a4 _except_handler4_common

• 0x4381a8 memmove

• 0x4381ac __std_terminate

• 0x4381b0 __RTDynamicCast

• 0x4381b4 strchr

• 0x4381b8 __std_type_info_compare

• 0x4381bc memcmp

Library api-ms-win-crt-stdio-l1-1-0.dll:

• 0x4382b8 ungetc

• 0x4382bc fputc

• 0x4382c0 fflush

• 0x4382c4 fclose

• 0x4382c8 fgetc

• 0x4382cc _set_fmode

• 0x4382d0 __p__commode

• 0x4382d4 fwrite

• 0x4382d8 __stdio_common_vsprintf

• 0x4382dc _get_stream_buffer_pointers

• 0x4382e0 fgetpos

• 0x4382e4 _fseeki64

• 0x4382e8 fread

• 0x4382ec fsetpos

• 0x4382f0 setvbuf

Library api-ms-win-crt-filesystem-l1-1-0.dll:

• 0x438218 _unlock_file

• 0x43821c _lock_file

Library api-ms-win-crt-runtime-l1-1-0.dll:

• 0x438264 _initialize_onexit_table

• 0x438268 _register_thread_local_exe_atexit_callback

• 0x43826c _c_exit

• 0x438270 _cexit

• 0x438274 _errno

• 0x438278 _exit

• 0x43827c exit

• 0x438280 _initterm_e

• 0x438284 _initterm

• 0x438288 _get_narrow_winmain_command_line

• 0x43828c _configure_narrow_argv

• 0x438290 _register_onexit_function

• 0x438294 _set_app_type

• 0x438298 _seh_filter_exe

• 0x43829c _crt_atexit

• 0x4382a0 _controlfp_s

• 0x4382a4 _invalid_parameter_noinfo

• 0x4382a8 _invalid_parameter_noinfo_noreturn

• 0x4382ac _initialize_narrow_environment

• 0x4382b0 terminate

Library api-ms-win-crt-heap-l1-1-0.dll:

• 0x438224 free

• 0x438228 _aligned_malloc

• 0x43822c _callnewh

• 0x438230 _aligned_free

• 0x438234 realloc

• 0x438238 malloc

• 0x43823c _set_new_mode

Library api-ms-win-crt-convert-l1-1-0.dll:

• 0x43820c strtoull

• 0x438210 strtol

Library api-ms-win-crt-string-l1-1-0.dll:

• 0x4382f8 _stricmp

• 0x4382fc tolower

Library api-ms-win-crt-math-l1-1-0.dll:

• 0x438250 _except1

• 0x438254 __setusermatherr

• 0x438258 _dtest

• 0x43825c _dsign

Library api-ms-win-crt-time-l1-1-0.dll:

• 0x438304 _time64

• 0x438308 _localtime64_s

Library api-ms-win-crt-locale-l1-1-0.dll:

• 0x438244 localeconv

• 0x438248 _configthreadlocale

Library WS2_32.dll:

• 0x4381c4 WSACleanup

• 0x4381c8 select

• 0x4381cc __WSAFDIsSet

• 0x4381d0 closesocket

• 0x4381d4 WSASocketW

• 0x4381d8 getaddrinfo

• 0x4381dc WSAStartup

• 0x4381e0 getpeername

• 0x4381e4 WSAGetLastError

• 0x4381e8 setsockopt

• 0x4381ec getnameinfo

• 0x4381f0 ioctlsocket

• 0x4381f4 freeaddrinfo

• 0x4381f8 getsockopt

• 0x4381fc recv

• 0x438200 connect

• 0x438204 send

Library RPCRT4.dll:

• 0x438174 UuidCreate

• 0x438178 UuidToStringW

• 0x43817c RpcStringFreeW

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
redirector.gvt1.com	A 203.208.41.65	203.208.41.65
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
r1---sn-j5o76n7l.gvt1.com	A 58.63.233.66 CNAME r1.sn-j5o76n7l.gvt1.com	58.63.233.66
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.40.34	203.208.40.34
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49178	203.208.40.34 update.googleapis.com	443
192.168.56.101	49179	203.208.41.65 redirector.gvt1.com	80
192.168.56.101	49180	58.63.233.66 r1---sn-j5o76n7l.gvt1.com	80

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	60221	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: redirector.gvt1.com
http://r1---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.99&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1620107538&mv=m&mvi=1&pl=23&shardbypass=yes	HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.99&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1620107538&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.5 X-Old-UID: cnt=0 X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Host: r1---sn-j5o76n7l.gvt1.com

URI

Data

http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe

HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com

http://r1---sn-j5o76n7l.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.99&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1620107538&mv=m&mvi=1&pl=23&shardbypass=yes

HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.99&mm=28&mn=sn-j5o76n7l&ms=nvh&mt=1620107538&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o76n7l.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.