1.4
低危

d5ab9e243085ce0828d45f35bb4b5380460e58722189a62c7c78fe4f11b95c1c

20b53f8e13ca71a6954e25af083181db.exe

分析耗时

72s

最近分析

文件大小

13.0KB
静态报毒 动态报毒 RAMNITCRTD
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20181112 6.0.6.653
Alibaba 20180921 0.1.0.2
Baidu 20181112 1.0.0.2
Avast 20181112 18.4.3895.0
Kingsoft 20181113 2013.8.14.323
Tencent 20181113 1.0.0.1
CrowdStrike 20181022 1.0
静态指标
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path D:\HOffice90-Master-2013\Build\WindowsOfficeViewer\Bin\HncCefBrowser.pdb
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2017-01-31 17:34:03

Imports

Library KERNEL32.dll:
0x402010 GetLastError
0x402014 DecodePointer
0x40201c GetCurrentThreadId
0x402020 GetCurrentProcessId
0x40202c EncodePointer
0x402030 OutputDebugStringW
0x402034 IsDebuggerPresent
Library MSVCR120.dll:
0x402040 __dllonexit
0x402044 _onexit
0x402048 _XcptFilter
0x402050 _amsg_exit
0x402054 _calloc_crt
0x402058 __set_app_type
0x40205c exit
0x402060 _exit
0x402064 _cexit
0x402068 _configthreadlocale
0x40206c __setusermatherr
0x402070 _initterm_e
0x402074 _initterm
0x402078 _wcmdln
0x40207c _fmode
0x402080 _commode
0x402084 _crt_debugger_hook
0x402094 ?terminate@@YAXXZ
0x40209c _invoke_watson
0x4020a0 _controlfp_s
0x4020a4 _unlock
0x4020a8 _lock
0x4020ac memset
0x4020b0 free
0x4020b4 ??3@YAXPAX@Z
0x4020b8 __wgetmainargs

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49714 239.255.255.250 3702
192.168.56.101 49716 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.