SmartHawk

2.4

中危

1 个模型检测该样本为恶意！

重新分析

下载样本

bf4ea04bcdceebf1c45ee033e22b3a53054b66d40029678592149247b464db9f

20191e19d374054f3087f88c6b15bc25.exe

分析耗时

79s

最近分析

文件大小

366.0KB

静态报毒动态报毒 CLOUD UNDEFINED

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀时间	查杀版本
McAfee	20200616	6.0.6.653
Alibaba	20190527	0.3.0.5
Baidu	20190318	1.0.0.2
Avast	20200616	18.4.3895.0
Kingsoft	20200616	2013.8.14.323
Tencent	20200616	1.0.0.1
CrowdStrike	20190702	1.0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1620119615.578046 IsDebuggerPresent		failed	0	0
1620123247.637125 IsDebuggerPresent		failed	0	0

This executable is signed

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Creates executable files on the filesystem (2 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS558D.tmp\ddengine.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS558D.tmp\winvnc.exe

Drops an executable to the user AppData folder (3 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS558D.tmp\ddengine.dll
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS558D.tmp\MSRC4Plugin.dsm
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7zS558D.tmp\winvnc.exe

File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)

Rising

Malware.Undefined!8.C (CLOUD)

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2005-01-17 01:28:05

Imports

Library COMCTL32.dll:

• 0x414000

Library KERNEL32.dll:

• 0x414008 DeleteCriticalSection

• 0x41400c InitializeCriticalSection

• 0x414010 CloseHandle

• 0x414014 WaitForMultipleObjects

• 0x414018 SetEvent

• 0x41401c CreateThread

• 0x414020 WaitForSingleObject

• 0x414024 ResetEvent

• 0x414028 VirtualAlloc

• 0x41402c VirtualFree

• 0x414030 MultiByteToWideChar

• 0x414034 WideCharToMultiByte

• 0x414038 GetLastError

• 0x41403c CompareStringW

• 0x414040 CompareStringA

• 0x414044 AreFileApisANSI

• 0x414048 GetModuleFileNameA

• 0x41404c GetModuleFileNameW

• 0x414050 LocalFree

• 0x414054 FormatMessageA

• 0x414058 FormatMessageW

• 0x41405c GetWindowsDirectoryA

• 0x414060 SetFileAttributesA

• 0x414064 SetFileAttributesW

• 0x414068 RemoveDirectoryA

• 0x41406c RemoveDirectoryW

• 0x414070 CreateDirectoryA

• 0x414074 CreateDirectoryW

• 0x414078 DeleteFileA

• 0x41407c DeleteFileW

• 0x414080 GetShortPathNameA

• 0x414084 lstrlenA

• 0x414088 GetFullPathNameA

• 0x41408c GetFullPathNameW

• 0x414090 GetCurrentDirectoryA

• 0x414094 SetCurrentDirectoryA

• 0x414098 GetTempPathA

• 0x41409c GetTempFileNameA

• 0x4140a0 FindClose

• 0x4140a4 FindFirstFileA

• 0x4140a8 FindFirstFileW

• 0x4140ac SetLastError

• 0x4140b0 FindNextFileA

• 0x4140b4 CreateFileA

• 0x4140b8 CreateFileW

• 0x4140bc GetFileSize

• 0x4140c0 SetFilePointer

• 0x4140c4 ReadFile

• 0x4140c8 SetFileTime

• 0x4140cc WriteFile

• 0x4140d0 SetEndOfFile

• 0x4140d4 CreateEventA

• 0x4140d8 LeaveCriticalSection

• 0x4140dc EnterCriticalSection

• 0x4140e0 Sleep

• 0x4140e4 CreateProcessA

• 0x4140e8 GetCommandLineW

• 0x4140ec GetModuleHandleA

• 0x4140f0 GetStartupInfoA

Library USER32.dll:

• 0x414170 DestroyWindow

• 0x414174 PostMessageA

• 0x414178 ShowWindow

• 0x41417c MessageBoxA

• 0x414180 KillTimer

• 0x414184 EndDialog

• 0x414188 SendMessageA

• 0x41418c GetDlgItem

• 0x414190 SetTimer

• 0x414194 MessageBoxW

• 0x414198 SetWindowTextW

• 0x41419c SetWindowTextA

• 0x4141a0 LoadStringW

• 0x4141a4 LoadStringA

• 0x4141a8 CharPrevA

• 0x4141ac DialogBoxParamA

• 0x4141b0 SetWindowLongA

• 0x4141b4 GetWindowLongA

Library OLEAUT32.dll:

• 0x414164 SysAllocString

• 0x414168 VariantClear

Library MSVCRT.dll:

• 0x4140f8 _controlfp

• 0x4140fc __set_app_type

• 0x414100 __p__fmode

• 0x414104 __p__commode

• 0x414108 _adjust_fdiv

• 0x41410c __setusermatherr

• 0x414110 _initterm

• 0x414114 __getmainargs

• 0x414118 _acmdln

• 0x41411c exit

• 0x414120 _XcptFilter

• 0x414124 _exit

• 0x414128 _onexit

• 0x41412c __dllonexit

• 0x414130 _except_handler3

• 0x414134 ??1type_info@@UAE@XZ

• 0x414138 memcpy

• 0x41413c free

• 0x414140 malloc

• 0x414144 memmove

• 0x414148 _purecall

• 0x41414c memcmp

• 0x414150 _CxxThrowException

• 0x414154 __CxxFrameHandler

• 0x414158 ??2@YAPAXI@Z

• 0x41415c ??3@YAXPAX@Z

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.