SmartHawk

6.0

高危

该样本未表现出任何异常！

重新分析

下载样本

e76bec8296bd5cbfda99663d0ab1056dd2dcf34d7bc19cfbeea62b8b11876d5b

162dbeec448c7757134d86a57893d831.exe

分析耗时

88s

最近分析

文件大小

9.5MB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

One or more processes crashed (4 个事件)

Time & API	Arguments	Status
1620842161.223875 __exception__	stacktrace: dbkFCallWrapperAddr+0x3ab18ef 162dbeec448c7757134d86a57893d831+0x3dccf2b @ 0x3f4cf2b dbkFCallWrapperAddr+0x3a1a51a 162dbeec448c7757134d86a57893d831+0x3d35b56 @ 0x3eb5b56 registers.esp: 73660908 registers.edi: 62541824 registers.eax: 73660908 registers.ebp: 73660988 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2010805291 registers.ecx: 3400990720 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x778eb727	success
1620842161.332875 __exception__	stacktrace: registers.esp: 73661028 registers.edi: 73674442 registers.eax: 1750617430 registers.ebp: 62541824 registers.edx: 22614 registers.ebx: 2147483650 registers.esi: 64657090 registers.ecx: 20 exception.instruction_r: ed e9 d2 75 ff ff c3 e9 93 a2 ff ff 46 cd aa 70 exception.symbol: dbkFCallWrapperAddr+0x3b4483b 162dbeec448c7757134d86a57893d831+0x3e5fe77 exception.instruction: in eax, dx exception.module: 162dbeec448c7757134d86a57893d831.exe exception.exception_code: 0xc0000096 exception.offset: 65404535 exception.address: 0x3fdfe77	success
1620842161.332875 __exception__	stacktrace: registers.esp: 73661028 registers.edi: 73674442 registers.eax: 1447909480 registers.ebp: 62541824 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 64657090 registers.ecx: 10 exception.instruction_r: ed e9 3b 3e 0f 00 4a 9e ff ff a2 00 77 00 3b 00 exception.symbol: dbkFCallWrapperAddr+0x3a4e3d5 162dbeec448c7757134d86a57893d831+0x3d69a11 exception.instruction: in eax, dx exception.module: 162dbeec448c7757134d86a57893d831.exe exception.exception_code: 0xc0000096 exception.offset: 64395793 exception.address: 0x3ee9a11	success
1620842163.238875 __exception__	stacktrace: __dbk_fcall_wrapper+0x1ceb4 TMethodImplementationIntercept-0xab958 162dbeec448c7757134d86a57893d831+0x2e8c0 @ 0x1ae8c0 __dbk_fcall_wrapper+0x1ceb4 TMethodImplementationIntercept-0xab958 162dbeec448c7757134d86a57893d831+0x2e8c0 @ 0x1ae8c0 TMethodImplementationIntercept+0x1504ab dbkFCallWrapperAddr-0xf0f79 162dbeec448c7757134d86a57893d831+0x22a6c3 @ 0x3aa6c3 0x463faac registers.esp: 73660444 registers.edi: 73660676 registers.eax: 73660444 registers.ebp: 73660524 registers.edx: 0 registers.ebx: 126 registers.esi: 0 registers.ecx: 7 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x778eb727	success

Allocates read-write-execute memory (usually to unpack itself) (6 个事件)

Time & API	Arguments	Status
1620842161.192875 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77dcf000	success
1620842161.192875 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77d40000	success
1620842162.160875 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 16384 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x03561000	success
1620842162.160875 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x03561000	success
1620842162.160875 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x03561000	success
1620842162.801875 NtAllocateVirtualMemory	process_identifier: 1176 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x06080000	success

The binary likely contains encrypted or compressed data indicative of a packer (10 个事件)

entropy

7.98210667939138

section

{'size_of_data': '0x0010fe00', 'virtual_address': '0x00001000', 'entropy': 7.98210667939138, 'name': '.text', 'virtual_size': '0x00306c64'}

description