1.2
低危
该样本未表现出任何异常！
重新分析
更多

8e679f87ba503f3dfad96266ca79de7bfe3092dc6a58c0fe0438f7d4b19f0bbd

2395868a72bfe1fd5e888b679faab621.exe

分析耗时

20s

最近分析

文件大小

721.0KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba 20190527 0.3.0.5
CrowdStrike 20210203 1.0
Tencent 20210326 1.0.0.1
Kingsoft 20210326 2017.9.26.565
静态指标
Command line console output was observed (4 个事件)
Time & API Arguments Status Return Repeated
1620130262.018125
WriteConsoleA
buffer: 7-Zip (a) 18.06 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-12-30
console_handle: 0x00000007
success 1 0
1620130262.034125
WriteConsoleA
buffer: Usage: 7za <command> [<switches>...] <archive_name> [<file_names>...] <Commands> a : Add files to archive b : Benchmark d : Delete files from archive e : Extract files from archive (without using directory names) h : Calculate hash values for files i : Show information about supported formats l : List contents of archive rn : Rename files in archive t : Test integrity of archive u : Update files to archive x : eXtract files with full paths <Switches> -- : Stop switches parsing @listfile : set path to listfile that contains file names -ai[r[-|0]]{@listfile|!wildcard} : Include archives -ax[r[-|0]]{@listfile|!wildcard} : eXclude archives -ao{a|s|t|u} : set Overwrite mode -an : disable archive_name field -bb[0-3] : set output log level -bd : disable progress indicator -bs{o|e|p}{0|1|2} : set output stream for output/error/progress line -bt : show execution time statistics -i[r[-|0]]{@listfile|!wildcard} : Include filenames -m{Parameters}
console_handle: 0x00000007
success 1 0
1620130262.049125
WriteConsoleA
buffer: : set compression Method -mmt[N] : set number of CPU threads -mx[N] : set compression level: -mx1 (fastest) ... -mx9 (ultra) -o{Directory} : set Output directory -p{Password} : set Password -r[-|0] : Recurse subdirectories -sa{a|e|s} : set Archive name mode -scc{UTF-8|WIN|DOS} : set charset for for console input/output -scs{UTF-8|UTF-16LE|UTF-16BE|WIN|DOS|{id}} : set charset for list files -scrc[CRC32|CRC64|SHA1|SHA256|*] : set hash function for x, e, h commands -sdel : delete files after compression -seml[.] : send archive by email -sfx[{name}] : Create SFX archive -si[{name}] : read data from stdin -slp : set Large Pages mode -slt : show technical information for l (List) command -snh : store hard links as links -snl : store symbolic links as links -sni : store NT security information -sns[-] : store NTFS alternate streams -so : write data to stdout -spd : disable wildcard matching for file names -spe : eliminate duplication of root folde
console_handle: 0x00000007
success 1 0
1620130262.065125
WriteConsoleA
buffer: r for extract command -spf : use fully qualified file paths -ssc[-] : set sensitive case mode -sse : stop archive creating, if it can't open some input file -ssw : compress shared files -stl : set archive timestamp from the most recently modified file -stm{HexMask} : set CPU thread affinity mask (hexadecimal number) -stx{Type} : exclude archive type -t{Type} : Set type of archive -u[-][p#][q#][r#][x#][y#][z#][!newArchiveName] : Update options -v{Size}[b|k|m|g] : Create volumes -w[{path}] : assign Work directory. Empty path means a temporary directory -x[r[-|0]]{@listfile|!wildcard} : eXclude filenames -y : assume Yes on all queries
console_handle: 0x00000007
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .sxdata
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2018-12-30 15:00:00

Imports

Library OLEAUT32.dll:
• 0x49a204 VariantCopy
• 0x49a208 SysAllocStringLen
• 0x49a20c SysAllocString
• 0x49a210 SysFreeString
• 0x49a214 SysStringLen
• 0x49a218 VariantClear
Library USER32.dll:
• 0x49a220 CharPrevExA
• 0x49a224 CharUpperW
Library ADVAPI32.dll:
• 0x49a000 SetFileSecurityW
• 0x49a004 OpenProcessToken
• 0x49a010 GetFileSecurityW
Library MSVCRT.dll:
• 0x49a15c _controlfp
• 0x49a160 __set_app_type
• 0x49a164 __p__fmode
• 0x49a168 __p__commode
• 0x49a16c _adjust_fdiv
• 0x49a170 __setusermatherr
• 0x49a174 _initterm
• 0x49a178 __getmainargs
• 0x49a17c __p___initenv
• 0x49a180 exit
• 0x49a184 _XcptFilter
• 0x49a188 _exit
• 0x49a18c _onexit
• 0x49a190 __dllonexit
• 0x49a198 ?terminate@@YAXXZ
• 0x49a19c _except_handler3
• 0x49a1a0 _beginthreadex
• 0x49a1a4 realloc
• 0x49a1a8 strlen
• 0x49a1ac memset
• 0x49a1b0 wcscmp
• 0x49a1b4 wcsstr
• 0x49a1b8 strcmp
• 0x49a1bc strstr
• 0x49a1c0 memmove
• 0x49a1c4 fputs
• 0x49a1c8 fputc
• 0x49a1cc fflush
• 0x49a1d0 fgetc
• 0x49a1d4 fclose
• 0x49a1d8 _iob
• 0x49a1dc free
• 0x49a1e0 _CxxThrowException
• 0x49a1e4 malloc
• 0x49a1e8 memcmp
• 0x49a1ec _purecall
• 0x49a1f0 memcpy
• 0x49a1f4 __CxxFrameHandler
• 0x49a1f8 _isatty
• 0x49a1fc _fileno
Library KERNEL32.dll:
• 0x49a018 ResetEvent
• 0x49a01c CreateSemaphoreW
• 0x49a020 CreateEventW
• 0x49a024 WaitForSingleObject
• 0x49a028 ReleaseSemaphore
• 0x49a030 VirtualFree
• 0x49a034 SetEvent
• 0x49a038 MoveFileW
• 0x49a03c VirtualAlloc
• 0x49a048 SetConsoleMode
• 0x49a04c GetConsoleMode
• 0x49a050 GetVersionExW
• 0x49a054 SetFileApisToOEM
• 0x49a058 GetCommandLineW
• 0x49a06c GetProcessTimes
• 0x49a070 OpenEventW
• 0x49a074 OpenFileMappingW
• 0x49a078 MapViewOfFile
• 0x49a07c UnmapViewOfFile
• 0x49a090 GetStdHandle
• 0x49a0a0 GlobalMemoryStatus
• 0x49a0a4 GetSystemInfo
• 0x49a0b4 CompareFileTime
• 0x49a0b8 GetCurrentProcess
• 0x49a0bc GetDiskFreeSpaceW
• 0x49a0c4 SetEndOfFile
• 0x49a0c8 WriteFile
• 0x49a0cc ReadFile
• 0x49a0d0 DeviceIoControl
• 0x49a0d4 SetFilePointer
• 0x49a0d8 GetFileSize
• 0x49a0dc GetLastError
• 0x49a0e0 MultiByteToWideChar
• 0x49a0e4 WideCharToMultiByte
• 0x49a0e8 FreeLibrary
• 0x49a0ec LoadLibraryW
• 0x49a0f0 GetModuleFileNameW
• 0x49a0f4 LocalFree
• 0x49a0f8 FormatMessageW
• 0x49a0fc CloseHandle
• 0x49a100 SetFileTime
• 0x49a104 CreateFileW
• 0x49a108 SetFileAttributesW
• 0x49a10c RemoveDirectoryW
• 0x49a114 GetProcAddress
• 0x49a118 GetModuleHandleW
• 0x49a11c CreateDirectoryW
• 0x49a120 DeleteFileW
• 0x49a124 SetLastError
• 0x49a130 GetTempPathW
• 0x49a134 GetCurrentProcessId
• 0x49a138 GetTickCount
• 0x49a13c GetCurrentThreadId
• 0x49a140 FindClose
• 0x49a144 FindFirstFileW
• 0x49a148 FindNextFileW
• 0x49a14c GetModuleHandleA
• 0x49a150 GetFileAttributesW

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.