1.8
低危
该样本未表现出任何异常！
重新分析
更多

944feecacd60e14023e8ea489b9deb001c8d988d95e3440b77e03a9f1cdb6f20

244f93ce7c8a87a5e3b2f1b2a49612a6.exe

分析耗时

74s

最近分析

文件大小

7.6MB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1619302289.618749
IsDebuggerPresent
failed 0 0
This executable is signed
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1619269231.008465
GlobalMemoryStatusEx
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)
Time & API Arguments Status Return Repeated
1619269230.805465
GetDiskFreeSpaceExW
root_path: C:
free_bytes_available: 19602202624
total_number_of_free_bytes: 19602202624
total_number_of_bytes: 34252779520
success 1 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-08-14 21:40:35

Imports

Library MSVCRT.dll:
• 0x401098 _controlfp
• 0x40109c __set_app_type
• 0x4010a0 __p__fmode
• 0x4010a4 __p__commode
• 0x4010a8 _adjust_fdiv
• 0x4010ac _wsplitpath
• 0x4010b0 __setusermatherr
• 0x4010b4 _initterm
• 0x4010b8 __getmainargs
• 0x4010bc _acmdln
• 0x4010c0 exit
• 0x4010c4 _XcptFilter
• 0x4010c8 _exit
• 0x4010cc free
• 0x4010d0 calloc
• 0x4010d4 memcpy
• 0x4010d8 _except_handler3
• 0x4010dc memchr
• 0x4010e0 memcmp
• 0x4010e4 _itoa
• 0x4010e8 strlen
• 0x4010ec ??2@YAPAXI@Z
• 0x4010f0 ??3@YAXPAX@Z
• 0x4010f4 wcsstr
• 0x4010f8 strstr
• 0x4010fc wcschr
• 0x401100 wcslen
• 0x401104 wcscat
• 0x401108 memset
• 0x40110c wcsncpy
• 0x401110 __CxxFrameHandler
• 0x401114 wcscpy
Library KERNEL32.dll:
• 0x401014 GetStartupInfoA
• 0x401018 GetFileSize
• 0x40101c CreateFileMappingA
• 0x401020 GetFileTime
• 0x401024 SetFileTime
• 0x401028 MapViewOfFile
• 0x40102c ExitThread
• 0x401030 UnmapViewOfFile
• 0x401034 FormatMessageA
• 0x401038 CreateFileW
• 0x40103c SetFilePointer
• 0x401040 WriteFile
• 0x401044 lstrlenA
• 0x401048 LocalFree
• 0x40104c GetCurrentProcess
• 0x401050 WaitForSingleObject
• 0x401054 GetExitCodeThread
• 0x401058 GetModuleFileNameW
• 0x40105c CreateProcessW
• 0x401060 CloseHandle
• 0x401064 CreateMutexA
• 0x401068 ExitProcess
• 0x40106c GetTempPathW
• 0x401070 GetFileAttributesW
• 0x401074 CreateDirectoryW
• 0x401078 CreateThread
• 0x40107c LoadLibraryA
• 0x401080 FreeLibrary
• 0x401084 GetModuleHandleA
• 0x401088 GetDiskFreeSpaceW
• 0x40108c GetProcAddress
• 0x401090 GetLastError
Library USER32.dll:
• 0x401128 SetForegroundWindow
• 0x40112c ShowWindow
• 0x401130 FindWindowA
• 0x401134 wsprintfA
• 0x401138 DestroyWindow
• 0x40113c MessageBoxA
• 0x401140 SetWindowTextA
• 0x401144 SendMessageA
• 0x401148 GetMessageA
• 0x40114c TranslateMessage
• 0x401150 DispatchMessageA
• 0x401154 wsprintfW
• 0x401158 PostQuitMessage
• 0x40115c CreateDialogParamA
Library ADVAPI32.dll:
• 0x401000 RegDeleteValueW
• 0x401004 RegQueryValueExW
• 0x401008 RegOpenKeyExA
• 0x40100c RegCloseKey
Library SHELL32.dll:
• 0x401120 SHBrowseForFolderW

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58370 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702
192.168.56.101 50534 8.8.8.8 53
192.168.56.101 58367 8.8.8.8 53
192.168.56.101 65004 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.