SmartHawk

0.8

低危

该样本未表现出任何异常！

重新分析

下载样本

b2d976b07a5dfaffd7f952f4174fcab4c333dece2c84988810904c9feae23a13

1870de5b8e08e4f17f2508ba83b6738f.exe

分析耗时

15s

最近分析

文件大小

616.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Command line console output was observed (19 个事件)

Time & API	Arguments	Status	Return
1620119619.382474 WriteConsoleA	buffer: E console_handle: 0x00000007	success	1
1620119619.382474 WriteConsoleA	buffer: R console_handle: 0x00000007	success	1
1620119619.382474 WriteConsoleA	buffer: R console_handle: 0x00000007	success	1
1620119619.382474 WriteConsoleA	buffer: O console_handle: 0x00000007	success	1
1620119619.382474 WriteConsoleA	buffer: R console_handle: 0x00000007	success	1
1620119619.382474 WriteConsoleA	buffer: C console_handle: 0x00000007	success	1
1620119619.382474 WriteConsoleA	buffer: S console_handle: 0x00000007	success	1
1620119619.382474 WriteConsoleA	buffer: G console_handle: 0x00000007	success	1
1620119619.382474 WriteConsoleA	buffer: O console_handle: 0x00000007	success	1
1620119619.382474 WriteConsoleA	buffer: n console_handle: 0x00000007	success	1
1620119619.382474 WriteConsoleA	buffer: o console_handle: 0x00000007	success	1
1620119619.397474 WriteConsoleA	buffer: t console_handle: 0x00000007	success	1
1620119619.397474 WriteConsoleA	buffer: r console_handle: 0x00000007	success	1
1620119619.397474 WriteConsoleA	buffer: u console_handle: 0x00000007	success	1
1620119619.397474 WriteConsoleA	buffer: n console_handle: 0x00000007	success	1
1620119619.397474 WriteConsoleA	buffer: n console_handle: 0x00000007	success	1
1620119619.397474 WriteConsoleA	buffer: i console_handle: 0x00000007	success	1
1620119619.397474 WriteConsoleA	buffer: n console_handle: 0x00000007	success	1
1620119619.397474 WriteConsoleA	buffer: g console_handle: 0x00000007	success	1

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2017-08-31 03:35:14

Imports

Library USER32.dll:

• 0x47f198 GetAsyncKeyState

Library KERNEL32.dll:

• 0x47f008 CloseHandle

• 0x47f00c Sleep

• 0x47f010 OpenProcess

• 0x47f014 ReadProcessMemory

• 0x47f018 WriteProcessMemory

• 0x47f01c CreateToolhelp32Snapshot

• 0x47f020 Process32Next

• 0x47f024 Module32Next

• 0x47f028 FormatMessageW

• 0x47f02c WideCharToMultiByte

• 0x47f030 EnterCriticalSection

• 0x47f034 LeaveCriticalSection

• 0x47f038 DeleteCriticalSection

• 0x47f03c MultiByteToWideChar

• 0x47f040 EncodePointer

• 0x47f044 DecodePointer

• 0x47f048 SetLastError

• 0x47f04c InitializeCriticalSectionAndSpinCount

• 0x47f050 CreateEventW

• 0x47f054 TlsAlloc

• 0x47f058 TlsGetValue

• 0x47f05c TlsSetValue

• 0x47f060 TlsFree

• 0x47f064 GetSystemTimeAsFileTime

• 0x47f068 GetTickCount

• 0x47f06c GetModuleHandleW

• 0x47f070 GetProcAddress

• 0x47f074 CompareStringW

• 0x47f078 LCMapStringW

• 0x47f07c GetLocaleInfoW

• 0x47f080 GetStringTypeW

• 0x47f084 GetCPInfo

• 0x47f088 SetEvent

• 0x47f08c ResetEvent

• 0x47f090 WaitForSingleObjectEx

• 0x47f094 IsProcessorFeaturePresent

• 0x47f098 IsDebuggerPresent

• 0x47f09c UnhandledExceptionFilter

• 0x47f0a0 SetUnhandledExceptionFilter

• 0x47f0a4 GetStartupInfoW

• 0x47f0a8 QueryPerformanceCounter

• 0x47f0ac GetCurrentProcessId

• 0x47f0b0 GetCurrentThreadId

• 0x47f0b4 InitializeSListHead

• 0x47f0b8 GetCurrentProcess

• 0x47f0bc TerminateProcess

• 0x47f0c0 RaiseException

• 0x47f0c4 RtlUnwind

• 0x47f0c8 GetLastError

• 0x47f0cc FreeLibrary

• 0x47f0d0 LoadLibraryExW

• 0x47f0d4 GetModuleFileNameW

• 0x47f0d8 InterlockedPushEntrySList

• 0x47f0dc InterlockedFlushSList

• 0x47f0e0 ExitProcess

• 0x47f0e4 GetModuleHandleExW

• 0x47f0e8 HeapAlloc

• 0x47f0ec HeapFree

• 0x47f0f0 HeapReAlloc

• 0x47f0f4 GetStdHandle

• 0x47f0f8 WriteFile

• 0x47f0fc GetModuleFileNameA

• 0x47f100 GetCommandLineA

• 0x47f104 GetCommandLineW

• 0x47f108 GetACP

• 0x47f10c GetCurrentThread

• 0x47f110 GetDateFormatW

• 0x47f114 GetTimeFormatW

• 0x47f118 IsValidLocale

• 0x47f11c GetUserDefaultLCID

• 0x47f120 EnumSystemLocalesW

• 0x47f124 GetProcessHeap

• 0x47f128 GetFileType

• 0x47f12c FlushFileBuffers

• 0x47f130 GetConsoleCP

• 0x47f134 GetConsoleMode

• 0x47f138 ReadFile

• 0x47f13c SetFilePointerEx

• 0x47f140 SetConsoleCtrlHandler

• 0x47f144 GetTimeZoneInformation

• 0x47f148 IsValidCodePage

• 0x47f14c GetOEMCP

• 0x47f150 GetEnvironmentStringsW

• 0x47f154 FreeEnvironmentStringsW

• 0x47f158 SetEnvironmentVariableA

• 0x47f15c SetEnvironmentVariableW

• 0x47f160 OutputDebugStringA

• 0x47f164 OutputDebugStringW

• 0x47f168 CreateThread

• 0x47f16c FindClose

• 0x47f170 FindFirstFileExA

• 0x47f174 FindFirstFileExW

• 0x47f178 FindNextFileA

• 0x47f17c FindNextFileW

• 0x47f180 SetStdHandle

• 0x47f184 WriteConsoleW

• 0x47f188 ReadConsoleW

• 0x47f18c HeapSize

• 0x47f190 CreateFileW

Library ADVAPI32.dll:

• 0x47f000 SystemFunction036

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	55369	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.