SmartHawk

3.2

中危

该样本未表现出任何异常！

重新分析

下载样本

3f44d46764c6c797f82e146c53058ce0ec800987c2937e4f4bbc24da4a1a7c4b

1bf05706b4ef03bd497f1bd4d679c77e.exe

分析耗时

79s

最近分析

文件大小

3.0MB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620119620.100952 IsDebuggerPresent		failed	0	0
1620119624.428952 IsDebuggerPresent		failed	0	0

This executable is signed

This executable has a PDB path (1 个事件)

pdb_path

D:\_TLBB_RTM350\Prj\ClientLib\Tools\UpdateExeHead\Bin\Release\UpdateExeHead.pdb

Allocates read-write-execute memory (usually to unpack itself) (16 个事件)

Time & API	Arguments	Status
1620119620.240952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x750d1000	success
1620119620.365952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x746a1000	success
1620119623.006952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74f81000	success
1620119623.771952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x744b1000	success
1620119623.771952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76881000	success
1620119624.271952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74511000	success
1620119624.287952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74491000	success
1620119624.365952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74317000	success
1620119624.428952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x03c70000	success
1620119624.443952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74471000	success
1620119624.443952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x742a1000	success
1620119624.459952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74281000	success
1620119624.490952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x74261000	success
1620119624.490952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x740b1000	success
1620119624.506952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x740a1000	success
1620119624.787952 NtProtectVirtualMemory	process_identifier: 1176 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75c41000	success

Foreign language identified in PE resource (17 个事件)

name

RT_ICON

language

LANG_CHINESE

offset

0x000660a8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x000660a8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x000660a8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x000660a8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x000660a8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x000660a8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x000660a8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x000660a8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x000660a8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x000660a8

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_MENU

language

LANG_CHINESE

offset

0x00066560

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000004a

name

RT_DIALOG

language

LANG_CHINESE

offset

0x000665c0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000158

name

RT_STRING

language

LANG_CHINESE

offset

0x000669e8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000054

name

RT_ACCELERATOR

language

LANG_CHINESE

offset

0x000665b0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000010

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00066510

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000004c

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x00066510

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000004c

name

RT_VERSION

language

LANG_CHINESE

offset

0x00066718

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000002d0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Detects VirtualBox through the presence of a device (2 个事件)

file	\??\VBoxGuest
file	\??\VBoxMiniRdrDN

Detects VirtualBox through the presence of a file (1 个事件)

dll	C:\Windows\system32\VBoxMRXNP.dll

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2013-10-21 23:00:18

Imports

Library KERNEL32.dll:

• 0x42b008 CreateDirectoryA

• 0x42b00c GetTempPathA

• 0x42b010 GetPrivateProfileIntA

• 0x42b014 CreateProcessA

• 0x42b018 MoveFileA

• 0x42b01c WaitForSingleObject

• 0x42b020 CloseHandle

• 0x42b024 ResumeThread

• 0x42b028 ResetEvent

• 0x42b02c CreateEventA

• 0x42b030 SetEvent

• 0x42b034 OpenMutexA

• 0x42b038 GetLastError

• 0x42b03c CreateMutexA

• 0x42b040 Sleep

• 0x42b044 WriteFile

• 0x42b048 CreateFileA

• 0x42b04c VirtualAlloc

• 0x42b050 VirtualFree

• 0x42b054 EnterCriticalSection

• 0x42b058 LeaveCriticalSection

• 0x42b05c DeleteFileA

• 0x42b060 InitializeCriticalSection

• 0x42b064 FileTimeToLocalFileTime

• 0x42b068 InterlockedIncrement

• 0x42b06c InterlockedDecrement

• 0x42b070 GetLocaleInfoW

• 0x42b074 SetEnvironmentVariableA

• 0x42b078 CompareStringW

• 0x42b07c CompareStringA

• 0x42b080 SetEndOfFile

• 0x42b084 GetSystemInfo

• 0x42b088 VirtualProtect

• 0x42b08c LCMapStringW

• 0x42b090 LCMapStringA

• 0x42b094 IsValidCodePage

• 0x42b098 IsValidLocale

• 0x42b09c EnumSystemLocalesA

• 0x42b0a0 GetUserDefaultLCID

• 0x42b0a4 DeleteCriticalSection

• 0x42b0a8 GetModuleFileNameA

• 0x42b0ac GetStringTypeW

• 0x42b0b0 GetStringTypeA

• 0x42b0b4 IsBadCodePtr

• 0x42b0b8 IsBadReadPtr

• 0x42b0bc GetCPInfo

• 0x42b0c0 GetOEMCP

• 0x42b0c4 LoadLibraryA

• 0x42b0c8 VirtualQuery

• 0x42b0cc SetStdHandle

• 0x42b0d0 IsBadWritePtr

• 0x42b0d4 CopyFileA

• 0x42b0d8 InterlockedExchange

• 0x42b0dc GetACP

• 0x42b0e0 GetLocaleInfoA

• 0x42b0e4 GetThreadLocale

• 0x42b0e8 GetVersionExA

• 0x42b0ec RaiseException

• 0x42b0f0 GetFileSize

• 0x42b0f4 SetFilePointer

• 0x42b0f8 ReadFile

• 0x42b0fc GetShortPathNameA

• 0x42b100 MoveFileExA

• 0x42b104 MultiByteToWideChar

• 0x42b108 lstrlenA

• 0x42b10c WideCharToMultiByte

• 0x42b110 lstrlenW

• 0x42b114 GetCurrentDirectoryA

• 0x42b118 FlushFileBuffers

• 0x42b11c FileTimeToSystemTime

• 0x42b120 GetFileInformationByHandle

• 0x42b124 GetFileType

• 0x42b128 GetCurrentProcess

• 0x42b12c GetCurrentThreadId

• 0x42b130 ExitProcess

• 0x42b134 ExitThread

• 0x42b138 CreateThread

• 0x42b13c RtlUnwind

• 0x42b140 GetModuleHandleA

• 0x42b144 GetStartupInfoA

• 0x42b148 GetCommandLineA

• 0x42b14c HeapFree

• 0x42b150 HeapAlloc

• 0x42b154 GetTimeZoneInformation

• 0x42b158 QueryPerformanceCounter

• 0x42b15c GetTickCount

• 0x42b160 GetCurrentProcessId

• 0x42b164 GetSystemTimeAsFileTime

• 0x42b168 SetHandleCount

• 0x42b16c GetStdHandle

• 0x42b170 GetProcAddress

• 0x42b174 TlsAlloc

• 0x42b178 SetLastError

• 0x42b17c TlsFree

• 0x42b180 TlsSetValue

• 0x42b184 TlsGetValue

• 0x42b188 TerminateProcess

• 0x42b18c UnhandledExceptionFilter

• 0x42b190 SetUnhandledExceptionFilter

• 0x42b194 HeapReAlloc

• 0x42b198 HeapSize

• 0x42b19c FreeEnvironmentStringsA

• 0x42b1a0 GetEnvironmentStrings

• 0x42b1a4 FreeEnvironmentStringsW

• 0x42b1a8 GetEnvironmentStringsW

• 0x42b1ac HeapDestroy

• 0x42b1b0 HeapCreate

• 0x42b1b4 PeekNamedPipe

Library USER32.dll:

• 0x42b1e8 FindWindowA

• 0x42b1ec GetWindowRect

• 0x42b1f0 GetSystemMetrics

• 0x42b1f4 DialogBoxParamA

• 0x42b1f8 PostQuitMessage

• 0x42b1fc LoadIconA

• 0x42b200 SetDlgItemTextA

• 0x42b204 DefWindowProcA

• 0x42b208 MessageBoxA

• 0x42b20c GetDlgItem

• 0x42b210 EnableWindow

• 0x42b214 InvalidateRect

• 0x42b218 GetSystemMenu

• 0x42b21c EnableMenuItem

• 0x42b220 SendMessageA

• 0x42b224 SendDlgItemMessageA

• 0x42b228 MoveWindow

Library GDI32.dll:

• 0x42b000 SetTextColor

Library SHELL32.dll:

• 0x42b1bc SHBrowseForFolderA

• 0x42b1c0 SHGetPathFromIDListA

Library SHLWAPI.dll:

• 0x42b1c8 PathFindExtensionA

• 0x42b1cc PathRemoveFileSpecA

• 0x42b1d0 PathAppendA

• 0x42b1d4 PathRemoveBackslashA

• 0x42b1d8 PathRemoveBlanksA

• 0x42b1dc PathFileExistsA

• 0x42b1e0 PathFindFileNameA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.