SmartHawk

5.2

中危

该样本未表现出任何异常！

重新分析

下载样本

5cd50f5a6843809b8e82f11cfc6db59ba7bb1fd0a35971de412c2abcb1098c18

1ea0e9e2edb070f1f4923de46f8cf5d9.exe

分析耗时

81s

最近分析

文件大小

260.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619304836.795999 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (3 个事件)

Time & API	Arguments	Status	Return
1619304827.514999 CryptGenKey	crypto_handle: 0x006ddc30 algorithm_identifier: 0x0000660e () provider_handle: 0x00635238 flags: 1 key: fD}Âß ¹mldB¹	success	1
1619304836.827999 CryptExportKey	crypto_handle: 0x006ddc30 crypto_export_handle: 0x006349f8 buffer: f¤äë=¥\|Ò{y7?HùkÝÎ0¡aYN½Ù~W5&'%C$ïoØifÒzW*a/à^mÒtè[2ãIâoHË9Æ-Ô3äC·5>Ø\|pð§N_ý×©Î: blob_type: 1 flags: 64	success	1
1619304872.795999 CryptExportKey	crypto_handle: 0x006ddc30 crypto_export_handle: 0x006349f8 buffer: f¤ÉÔÚ-îÙ´NÚ¿8§&mcÁ©b;þoßÐy*ëûþ¹rO}$ÏïDM@ x¤ÅÌFß5-!9Éë8æÀ2DÓ»¬»½z/¦í2º6áµaeÄD blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619304826.592999 NtAllocateVirtualMemory	process_identifier: 3068 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01d80000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619304837.702999 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

7.206908979044397

section

{'size_of_data': '0x0000c000', 'virtual_address': '0x00039000', 'entropy': 7.206908979044397, 'name': '.rsrc', 'virtual_size': '0x0000ba08'}

description

A section with a high entropy has been found

Expresses interest in specific running processes (1 个事件)

process

1ea0e9e2edb070f1f4923de46f8cf5d9.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619304837.139999 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (3 个事件)

host	139.99.157.213
host	172.217.24.14
host	92.24.51.238

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619304840.280999 RegSetValueExA	key_handle: 0x000003b8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619304840.280999 RegSetValueExA	key_handle: 0x000003b8 value: \|Ø¾N9× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619304840.295999 RegSetValueExA	key_handle: 0x000003b8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619304840.295999 RegSetValueExW	key_handle: 0x000003b8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619304840.295999 RegSetValueExA	key_handle: 0x000003d0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619304840.295999 RegSetValueExA	key_handle: 0x000003d0 value: \|Ø¾N9× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619304840.295999 RegSetValueExA	key_handle: 0x000003d0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619304840.327999 RegSetValueExW	key_handle: 0x000003b4 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	139.99.157.213:8080
dead_host	92.24.51.238:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-12 04:17:57

Imports

Library KERNEL32.dll:

• 0x4280c0 GetTimeZoneInformation

• 0x4280c4 LCMapStringA

• 0x4280c8 LCMapStringW

• 0x4280cc Sleep

• 0x4280d0 UnhandledExceptionFilter

• 0x4280d4 FreeEnvironmentStringsA

• 0x4280d8 FreeEnvironmentStringsW

• 0x4280dc GetEnvironmentStrings

• 0x4280e0 GetEnvironmentStringsW

• 0x4280e4 SetHandleCount

• 0x4280e8 GetStdHandle

• 0x4280ec GetFileType

• 0x4280f0 HeapDestroy

• 0x4280f4 HeapCreate

• 0x4280f8 VirtualFree

• 0x4280fc VirtualAlloc

• 0x428100 GetACP

• 0x428104 SetUnhandledExceptionFilter

• 0x428108 GetStringTypeA

• 0x42810c GetStringTypeW

• 0x428110 IsBadReadPtr

• 0x428114 IsBadCodePtr

• 0x428118 SetStdHandle

• 0x42811c CompareStringA

• 0x428120 CompareStringW

• 0x428124 SetEnvironmentVariableA

• 0x428128 HeapSize

• 0x42812c HeapReAlloc

• 0x428130 RaiseException

• 0x428134 GetProfileStringA

• 0x428138 InterlockedExchange

• 0x42813c TerminateProcess

• 0x428140 HeapFree

• 0x428144 HeapAlloc

• 0x428148 GetCommandLineA

• 0x42814c GetStartupInfoA

• 0x428150 RtlUnwind

• 0x428154 GetFileTime

• 0x428158 GetFileSize

• 0x42815c GetFileAttributesA

• 0x428160 GetTickCount

• 0x428164 FileTimeToLocalFileTime

• 0x428168 FileTimeToSystemTime

• 0x42816c GetFullPathNameA

• 0x428170 GetVolumeInformationA

• 0x428174 FindFirstFileA

• 0x428178 FindClose

• 0x42817c SetEndOfFile

• 0x428180 UnlockFile

• 0x428184 LockFile

• 0x428188 FlushFileBuffers

• 0x42818c SetFilePointer

• 0x428190 WriteFile

• 0x428194 ReadFile

• 0x428198 CreateFileA

• 0x42819c GetCurrentProcess

• 0x4281a0 DuplicateHandle

• 0x4281a4 SetErrorMode

• 0x4281a8 GetOEMCP

• 0x4281ac GetCPInfo

• 0x4281b0 GetThreadLocale

• 0x4281b4 SizeofResource

• 0x4281b8 GetProcessVersion

• 0x4281bc WritePrivateProfileStringA

• 0x4281c0 GlobalFlags

• 0x4281c4 TlsGetValue

• 0x4281c8 LocalReAlloc

• 0x4281cc TlsSetValue

• 0x4281d0 GlobalReAlloc

• 0x4281d4 TlsFree

• 0x4281d8 GlobalHandle

• 0x4281dc TlsAlloc

• 0x4281e0 LocalAlloc

• 0x4281e4 EnterCriticalSection

• 0x4281e8 LeaveCriticalSection

• 0x4281ec DeleteCriticalSection

• 0x4281f0 InitializeCriticalSection

• 0x4281f4 lstrcpynA

• 0x4281f8 FormatMessageA

• 0x4281fc LocalFree

• 0x428200 MulDiv

• 0x428204 SetLastError

• 0x428208 LoadLibraryA

• 0x42820c FreeLibrary

• 0x428210 GetVersion

• 0x428214 lstrcatA

• 0x428218 GlobalGetAtomNameA

• 0x42821c GlobalAddAtomA

• 0x428220 GlobalFindAtomA

• 0x428224 lstrcpyA

• 0x428228 GetModuleHandleA

• 0x42822c GetProcAddress

• 0x428230 GlobalUnlock

• 0x428234 GlobalFree

• 0x428238 LockResource

• 0x42823c FindResourceA

• 0x428240 LoadResource

• 0x428244 CloseHandle

• 0x428248 GetModuleFileNameA

• 0x42824c GlobalLock

• 0x428250 GlobalAlloc

• 0x428254 GlobalDeleteAtom

• 0x428258 lstrcmpA

• 0x42825c lstrcmpiA

• 0x428260 GetCurrentThread

• 0x428264 GetCurrentThreadId

• 0x428268 MultiByteToWideChar

• 0x42826c WideCharToMultiByte

• 0x428270 lstrlenA

• 0x428274 InterlockedDecrement

• 0x428278 InterlockedIncrement

• 0x42827c ExitProcess

• 0x428280 IsBadWritePtr

• 0x428284 GetLastError

Library USER32.dll:

• 0x4282c4 InvalidateRect

• 0x4282c8 CharUpperA

• 0x4282cc RegisterClipboardFormatA

• 0x4282d0 PostThreadMessageA

• 0x4282d4 UpdateWindow

• 0x4282d8 SendDlgItemMessageA

• 0x4282dc MapWindowPoints

• 0x4282e0 GetSysColor

• 0x4282e4 SetFocus

• 0x4282e8 AdjustWindowRectEx

• 0x4282ec ScreenToClient

• 0x4282f0 GetTopWindow

• 0x4282f4 IsChild

• 0x4282f8 GetCapture

• 0x4282fc WinHelpA

• 0x428300 wsprintfA

• 0x428304 GetClassInfoA

• 0x428308 RegisterClassA

• 0x42830c GetMenu

• 0x428310 GetMenuItemCount

• 0x428314 GetSubMenu

• 0x428318 GetMenuItemID

• 0x42831c GetWindowTextLengthA

• 0x428320 GetWindowTextA

• 0x428324 GetDlgCtrlID

• 0x428328 DefWindowProcA

• 0x42832c GetClassLongA

• 0x428330 SetPropA

• 0x428334 UnhookWindowsHookEx

• 0x428338 GetPropA

• 0x42833c CallWindowProcA

• 0x428340 RemovePropA

• 0x428344 GetMessageTime

• 0x428348 GetMessagePos

• 0x42834c SetForegroundWindow

• 0x428350 SetWindowLongA

• 0x428354 RegisterWindowMessageA

• 0x428358 OffsetRect

• 0x42835c IntersectRect

• 0x428360 SystemParametersInfoA

• 0x428364 CharNextA

• 0x428368 GetWindowRect

• 0x42836c MapDialogRect

• 0x428370 SetWindowPos

• 0x428374 GetWindow

• 0x428378 SetWindowContextHelpId

• 0x42837c CopyRect

• 0x428380 GetDC

• 0x428384 ReleaseDC

• 0x428388 EndDialog

• 0x42838c SetActiveWindow

• 0x428390 IsWindow

• 0x428394 CreateDialogIndirectParamA

• 0x428398 DestroyWindow

• 0x42839c GetDlgItem

• 0x4283a0 SetRect

• 0x4283a4 LoadBitmapA

• 0x4283a8 GetMenuState

• 0x4283ac ModifyMenuA

• 0x4283b0 SetMenuItemBitmaps

• 0x4283b4 CheckMenuItem

• 0x4283b8 EnableMenuItem

• 0x4283bc GetFocus

• 0x4283c0 GetNextDlgTabItem

• 0x4283c4 GetMessageA

• 0x4283c8 TranslateMessage

• 0x4283cc DispatchMessageA

• 0x4283d0 GetActiveWindow

• 0x4283d4 GetKeyState

• 0x4283d8 LoadIconA

• 0x4283dc CreateWindowExA

• 0x4283e0 InSendMessage

• 0x4283e4 UnregisterClassA

• 0x4283e8 HideCaret

• 0x4283ec ShowCaret

• 0x4283f0 ExcludeUpdateRgn

• 0x4283f4 DrawFocusRect

• 0x4283f8 CallNextHookEx

• 0x4283fc ValidateRect

• 0x428400 IsWindowVisible

• 0x428404 PeekMessageA

• 0x428408 GetCursorPos

• 0x42840c SetWindowsHookExA

• 0x428410 GetParent

• 0x428414 GetLastActivePopup

• 0x428418 IsWindowEnabled

• 0x42841c GetWindowLongA

• 0x428420 MessageBoxA

• 0x428424 SetCursor

• 0x428428 MessageBeep

• 0x42842c GetForegroundWindow

• 0x428430 GetNextDlgGroupItem

• 0x428434 PostQuitMessage

• 0x428438 PostMessageA

• 0x42843c EnableWindow

• 0x428440 IsIconic

• 0x428444 GetSystemMetrics

• 0x428448 GetClientRect

• 0x42844c DrawIcon

• 0x428450 GetSystemMenu

• 0x428454 DefDlgProcA

• 0x428458 IsWindowUnicode

• 0x42845c SendMessageA

• 0x428460 AppendMenuA

• 0x428464 InflateRect

• 0x428468 GetSysColorBrush

• 0x42846c PtInRect

• 0x428470 GetClassNameA

• 0x428474 GetDesktopWindow

• 0x428478 LoadCursorA

• 0x42847c GrayStringA

• 0x428480 DrawTextA

• 0x428484 TabbedTextOutA

• 0x428488 EndPaint

• 0x42848c BeginPaint

• 0x428490 GetWindowDC

• 0x428494 ClientToScreen

• 0x428498 DestroyMenu

• 0x42849c LoadStringA

• 0x4284a0 ShowWindow

• 0x4284a4 MoveWindow

• 0x4284a8 SetWindowTextA

• 0x4284ac IsDialogMessageA

• 0x4284b0 GetMenuCheckMarkDimensions

• 0x4284b4 CopyAcceleratorTableA

• 0x4284b8 GetWindowPlacement

Library GDI32.dll:

• 0x428020 ScaleViewportExtEx

• 0x428024 SetWindowExtEx

• 0x428028 ScaleWindowExtEx

• 0x42802c IntersectClipRect

• 0x428030 DeleteObject

• 0x428034 SetViewportExtEx

• 0x428038 GetDeviceCaps

• 0x42803c GetViewportExtEx

• 0x428040 GetWindowExtEx

• 0x428044 CreateSolidBrush

• 0x428048 PtVisible

• 0x42804c RectVisible

• 0x428050 TextOutA

• 0x428054 ExtTextOutA

• 0x428058 Escape

• 0x42805c GetMapMode

• 0x428060 DPtoLP

• 0x428064 GetTextColor

• 0x428068 GetBkColor

• 0x42806c LPtoDP

• 0x428070 OffsetViewportOrgEx

• 0x428074 SetViewportOrgEx

• 0x428078 SetMapMode

• 0x42807c SetBkMode

• 0x428080 GetStockObject

• 0x428084 SelectObject

• 0x428088 RestoreDC

• 0x42808c SaveDC

• 0x428090 DeleteDC

• 0x428094 GetObjectA

• 0x428098 SetBkColor

• 0x42809c SetTextColor

• 0x4280a0 GetClipBox

• 0x4280a4 PatBlt

• 0x4280a8 CreateDIBitmap

• 0x4280ac GetTextExtentPointA

• 0x4280b0 BitBlt

• 0x4280b4 CreateCompatibleDC

• 0x4280b8 CreateBitmap

Library comdlg32.dll:

• 0x4284d0 GetFileTitleA

Library WINSPOOL.DRV:

• 0x4284c0 ClosePrinter

• 0x4284c4 DocumentPropertiesA

• 0x4284c8 OpenPrinterA

Library ADVAPI32.dll:

• 0x428000 RegCreateKeyExA

• 0x428004 RegOpenKeyExA

• 0x428008 RegSetValueExA

• 0x42800c RegCloseKey

Library SHELL32.dll:

• 0x4282bc SHGetFileInfoA

Library COMCTL32.dll:

• 0x428014 ImageList_Destroy

• 0x428018

Library oledlg.dll:

• 0x428518

Library ole32.dll:

• 0x4284d8 CoFreeUnusedLibraries

• 0x4284dc OleInitialize

• 0x4284e0 CoTaskMemAlloc

• 0x4284e4 CoTaskMemFree

• 0x4284e8 CreateILockBytesOnHGlobal

• 0x4284ec StgCreateDocfileOnILockBytes

• 0x4284f0 StgOpenStorageOnILockBytes

• 0x4284f4 CoGetClassObject

• 0x4284f8 CLSIDFromString

• 0x4284fc CLSIDFromProgID

• 0x428500 CoRegisterMessageFilter

• 0x428504 CoRevokeClassObject

• 0x428508 OleFlushClipboard

• 0x42850c OleIsCurrentClipboard

• 0x428510 OleUninitialize

Library OLEPRO32.DLL:

• 0x4282b4

Library OLEAUT32.dll:

• 0x42828c VariantCopy

• 0x428290 VariantClear

• 0x428294 SysAllocStringLen

• 0x428298 SysFreeString

• 0x42829c VariantChangeType

• 0x4282a0 SysAllocString

• 0x4282a4 SysAllocStringByteLen

• 0x4282a8 SysStringLen

• 0x4282ac VariantTimeToSystemTime

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	50005	239.255.255.250	3702
192.168.56.101	51966	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.