2.6
中危
该样本未表现出任何异常！
重新分析
更多

f8e7d594a8adbd3aee4b1861bece8d1308d98cdbd4661512c39524ff7e1b75cc

1a37f5ff1fb82e87948ced9651d15c7e.exe

分析耗时

81s

最近分析

文件大小

6.7MB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1620148923.874626
IsDebuggerPresent
failed 0 0
This executable has a PDB path (1 个事件)
pdb_path C:\projects\open-shell-menu\Src\Setup\Release\Setup.pdb
The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)
resource name MSI_FILE
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1620148923.936626
__exception__
stacktrace: 
RtlEncodeSystemPointer+0x4cf RtlFindClearBits-0x2c2 ntdll+0x3e527 @ 0x77d6e527
LdrResFindResourceDirectory+0x51d RtlEncodeSystemPointer-0x126 ntdll+0x3df32 @ 0x77d6df32
LdrResSearchResource+0x943 LdrResFindResourceDirectory-0x376 ntdll+0x3d69f @ 0x77d6d69f
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7533d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
LoadLibraryExA+0x26 FreeLibrary-0x18 kernelbase+0x11d7a @ 0x778f1d7a
SHRestricted+0x4988 SHGetFolderPathEx-0x1bf5 shell32+0x83a6b @ 0x76963a6b
SHGetItemFromDataObject+0x182b SHTestTokenMembership-0x2beb shell32+0x500f7 @ 0x769300f7
MsiSetOfflineContextW+0x46c86 msi+0x11ef8b @ 0x7492ef8b
MsiSetOfflineContextW+0x4705a msi+0x11f35f @ 0x7492f35f
MsiSetOfflineContextW+0x4908d msi+0x121392 @ 0x74931392
MsiSetOfflineContextW+0x44418 msi+0x11c71d @ 0x7492c71d
MsiGetProductCodeW+0x7fe1 MsiInvalidateFeatureCache-0x36246 msi+0x36df5 @ 0x74846df5
MsiEnumProductsW+0x288b MsiReinstallFeatureW-0xdfc msi+0x17dd8 @ 0x74827dd8
MsiEnumProductsW+0x2ad8 MsiReinstallFeatureW-0xbaf msi+0x18025 @ 0x74828025
MsiReinstallFeatureW+0x2a4 MsiLoadStringW-0x1f41 msi+0x18e78 @ 0x74828e78
MsiInstallProductW+0xa1 MsiReinstallProductW-0x103 msi+0xacd9c @ 0x748bcd9c
msiexec+0xaa29 @ 0x2faa29
msiexec+0xafcc @ 0x2fafcc
msiexec+0x1c9c @ 0x2f1c9c
msiexec+0x1d56 @ 0x2f1d56
msiexec+0x3f51 @ 0x2f3f51
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 2213532
registers.edi: 3650513220
registers.eax: 3650513261
registers.ebp: 2213544
registers.edx: 1701996868
registers.ebx: 5677800
registers.esi: 1948517113
registers.ecx: 72
exception.instruction_r: 8a 27 83 c7 01 3a e0 74 ee 2c 41 3c 1a 1a c9 80
exception.symbol: _strcmpi+0x40 LdrpResGetMappingSize-0x203 ntdll+0x3c7f9
exception.instruction: mov ah, byte ptr [edi]
exception.module: ntdll.dll
exception.exception_code: 0xc0000005
exception.offset: 247801
exception.address: 0x77d6c7f9
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1620148923.796626
NtProtectVirtualMemory
process_identifier: 1316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x74341000
success 0 0
1620148923.811626
NtProtectVirtualMemory
process_identifier: 1316
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75041000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\ProgramData\OpenShellSetup64_4_4_152.msi
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.857193641381288 section {'size_of_data': '0x006a0c00', 'virtual_address': '0x0001e000', 'entropy': 7.857193641381288, 'name': '.rsrc', 'virtual_size': '0x006a0a70'} description A section with a high entropy has been found
entropy 0.9839797027908662 description Overall entropy of this PE file is high
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-09-02 01:32:39

Imports

Library KERNEL32.dll:
• 0x414000 SizeofResource
• 0x414004 GetCurrentProcess
• 0x414008 WriteFile
• 0x414010 WaitForSingleObject
• 0x414014 CreateFileW
• 0x414018 GetVersion
• 0x41401c LockResource
• 0x414020 DeleteFileW
• 0x414024 CloseHandle
• 0x414028 LoadResource
• 0x41402c FindResourceW
• 0x414030 GetProcAddress
• 0x414034 CreateProcessW
• 0x414038 GetModuleHandleW
• 0x41403c GetExitCodeProcess
• 0x414040 WriteConsoleW
• 0x414044 GetConsoleMode
• 0x414048 GetConsoleOutputCP
• 0x41404c FlushFileBuffers
• 0x414050 SetFilePointerEx
• 0x414054 GetCPInfo
• 0x414058 OutputDebugStringW
• 0x41405c MultiByteToWideChar
• 0x414060 GetLastError
• 0x414064 WideCharToMultiByte
• 0x414068 HeapFree
• 0x414070 HeapSize
• 0x414074 HeapReAlloc
• 0x414078 RaiseException
• 0x41407c HeapAlloc
• 0x414080 DecodePointer
• 0x414088 GetProcessHeap
• 0x414094 TerminateProcess
• 0x4140a8 CreateEventW
• 0x4140b0 GetCurrentProcessId
• 0x4140b4 GetCurrentThreadId
• 0x4140bc InitializeSListHead
• 0x4140c0 IsDebuggerPresent
• 0x4140c4 GetStartupInfoW
• 0x4140c8 RtlUnwind
• 0x4140cc SetLastError
• 0x4140d0 EncodePointer
• 0x4140d4 TlsAlloc
• 0x4140d8 TlsGetValue
• 0x4140dc TlsSetValue
• 0x4140e0 TlsFree
• 0x4140e4 FreeLibrary
• 0x4140e8 LoadLibraryExW
• 0x4140ec GetStdHandle
• 0x4140f0 GetModuleFileNameW
• 0x4140f4 ExitProcess
• 0x4140f8 GetModuleHandleExW
• 0x4140fc GetFileType
• 0x414100 FindClose
• 0x414104 FindFirstFileExW
• 0x414108 FindNextFileW
• 0x41410c IsValidCodePage
• 0x414110 GetACP
• 0x414114 GetOEMCP
• 0x414118 GetCommandLineA
• 0x41411c GetCommandLineW
• 0x414128 SetStdHandle
• 0x41412c GetStringTypeW
• 0x414130 LCMapStringW
Library USER32.dll:
• 0x414144 LoadStringW
• 0x414148 MessageBoxW
Library SHELL32.dll:
• 0x414138 DoEnvironmentSubstW
• 0x41413c CommandLineToArgvW

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.