8.2
高危
该样本未表现出任何异常！
重新分析
更多

aa556dde1f62e5e897bf5db6980f8202febe626f2e9840190f1f2695eec3c065

274b8be4390840eef16ac73f4e62b878.exe

分析耗时

31s

最近分析

文件大小

810.0KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)
section CODE
section DATA
section BSS
The executable uses a known packer (1 个事件)
packer BobSoft Mini Delphi -> BoB / BobSoft
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1619303307.075
__exception__
stacktrace: 
RtlFlsAlloc+0x421 EtwNotificationRegister-0x6ae ntdll+0x3ee84 @ 0x77d6ee84
RtlRunOnceComplete+0x3a4 LdrLoadDll-0xb1 ntdll+0x3c389 @ 0x77d6c389
LdrLoadDll+0x7b _strcmpi-0x304 ntdll+0x3c4b5 @ 0x77d6c4b5
New_ntdll_LdrLoadDll@16+0x7b New_ntdll_LdrUnloadDll@4-0xb7 @ 0x7485d4cf
LoadLibraryExW+0x178 LoadLibraryExA-0x2a kernelbase+0x11d2a @ 0x778f1d2a
274b8be4390840eef16ac73f4e62b878+0x623f8 @ 0x4623f8
_CorValidateImage+0x83f _CorExeMain-0x2cc mscoree+0x4b0f @ 0x75104b0f
_CorExeMain+0xf62 CreateConfigStream-0x209a mscoree+0x5d3d @ 0x75105d3d
0x57005c

registers.esp: 1633872
registers.edi: 0
registers.eax: 0
registers.ebp: 1633912
registers.edx: 582600
registers.ebx: 0
registers.esi: 1634116
registers.ecx: 176
exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0xfea014ad
success 0 0
行为判定
动态指标
One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.
Allocates read-write-execute memory (usually to unpack itself) (28 个事件)
Time & API Arguments Status Return Repeated
1619303303.1065
NtAllocateVirtualMemory
process_identifier: 284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02100000
success 0 0
1619303303.3725
NtProtectVirtualMemory
process_identifier: 284
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 73728
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00466000
success 0 0
1619303303.4195
NtAllocateVirtualMemory
process_identifier: 284
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x02230000
success 0 0
1619303305.653
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1619303306.247
NtAllocateVirtualMemory
process_identifier: 2440
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 8192 (MEM_RESERVE)
base_address: 0x01f00000
success 0 0
1619303306.247
NtAllocateVirtualMemory
process_identifier: 2440
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02090000
success 0 0
1619303306.247
NtAllocateVirtualMemory
process_identifier: 2440
region_size: 368640
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00530000
success 0 0
1619303306.263
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 339968
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00532000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ef2000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ef2000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ef2000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ef2000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ef2000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x77d4f000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ef2000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76353000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ef2000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ef2000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ef2000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76354000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x01ef2000
success 0 0
1619303307.059
NtProtectVirtualMemory
process_identifier: 2440
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x76351000
success 0 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\itsowne.vbs
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.529202126385433 section {'size_of_data': '0x00047c00', 'virtual_address': '0x00089000', 'entropy': 7.529202126385433, 'name': '.rsrc', 'virtual_size': '0x00047ab0'} description A section with a high entropy has been found
entropy 0.3547589616810878 description Overall entropy of this PE file is high
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 172.217.24.14
Allocates execute permission to another process indicative of possible code injection (1 个事件)
Time & API Arguments Status Return Repeated
1619303304.3415
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000114
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
Installs itself for autorun at Windows startup (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\itsowne.vbs
Creates a thread using NtQueueApcThread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 284 created a thread in remote process 648
Time & API Arguments Status Return Repeated
1619303304.3415
NtQueueApcThread
thread_handle: 0x00000110
process_identifier: 648
function_address: 0x000b05c0
parameter: 0x000c0000
success 0 0
Potential code injection by writing to the memory of another process (2 个事件)
Time & API Arguments Status Return Repeated
1619303304.3415
WriteProcessMemory
process_identifier: 648
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000114
base_address: 0x000b0000
success 1 0
1619303304.3415
WriteProcessMemory
process_identifier: 648
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\274b8be4390840eef16ac73f4e62b878.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\274b8be4390840eef16ac73f4e62b878.exe" itsowneset bpXSVCTIKURC = creaTeoBject("WSCrIPt.shell") BpxsVctikurC.run """%ls""", 0, False
process_handle: 0x00000114
base_address: 0x000c0000
success 1 0
Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 个事件)
Process injection Process 284 called NtSetContextThread to modify thread in remote process 2440
Time & API Arguments Status Return Repeated
1619303304.6225
NtSetContextThread
thread_handle: 0x0000011c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4972688
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2440
success 0 0
Resumed a suspended thread in a remote process potentially indicative of process injection (2 个事件)
Process injection Process 284 resumed a thread in remote process 2440
Time & API Arguments Status Return Repeated
1619303305.4035
NtResumeThread
thread_handle: 0x0000011c
suspend_count: 1
process_identifier: 2440
success 0 0
Generates some ICMP traffic
Executed a process and injected code into it, probably while unpacking (11 个事件)
Time & API Arguments Status Return Repeated
1619303304.3415
CreateProcessInternalW
thread_identifier: 428
thread_handle: 0x00000110
process_identifier: 648
current_directory:
filepath: C:\Windows\System32\notepad.exe
track: 1
command_line:
filepath_r: C:\Windows\system32\notepad.exe
stack_pivoted: 0
creation_flags: 32 (NORMAL_PRIORITY_CLASS)
process_handle: 0x00000114
inherit_handles: 0
success 1 0
1619303304.3415
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0x00000114
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000b0000
success 0 0
1619303304.3415
NtAllocateVirtualMemory
process_identifier: 648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 4 (PAGE_READWRITE)
process_handle: 0x00000114
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x000c0000
success 0 0
1619303304.3415
WriteProcessMemory
process_identifier: 648
buffer: Q¹0d‹‹@ ‹@ ‹‹‹@‰$‹$YÃVWR¾§ÆgNè„Yƒøv· ¿Zwf;Ït ¿Ntf;ÏuƒÂƒè…Àt‹ÎÁá‹þÁïϾ:Ï3ñBHué_‹Æ^ÃU‹ìQQ‹MSVW…Ét;¸MZf9u1‹A<Át*8PEu"‹@xƒeüÁ‹x‹X$‹p ‹@ùÙñ‰Eø…Àu 3À_^[ÉËM‹Eü‹†ÑèOÿÿÿ;E t ÿEü‹Eü;Eøràë׋Eü·C‹‡EëÊU‹ìQSW3ÿWWjWjh@ÿuÿV‹Øƒûÿu3Àë&WWWS‰}üÿV0W‹}EüPWÿu SÿV SÿV3À9}ü”À_[ÉÅÉtè•…Àt3Éf‰ÃU‹ììV‹ð…äüÿÿP3ÀPPjPÿVl…À…Žj\Xf‰Eü3Àj.f‰EþXjvf‰EðXf‰EòjbXf‰EôjsXf‰Eö3Àf‰EøUü…äüÿÿèÖ‹U è΍UðèÆÿu…ìþÿÿÿuPÿVxƒÄ …äüÿÿPÿV…ìþÿÿPèÂ@P…ìþÿÿP…äüÿÿPèîþÿÿƒÄ^ÉÃU‹ìì,j:XjZf‰EÜXjof‰EÞXjnf‰EàXjef‰EâXjIf‰EäXjdf‰EæXjef‰EèXjnf‰EêXjtf‰EìXjif‰EîXjff‰EðXjif‰EòXf‰EôjeXf‰EöjrXf‰Eø3Àf‰Eú…Ôýÿÿ謍UÜè÷EÿPÆEÿèPEÿP…ÔýÿÿPè?þÿÿƒÄÉÃU‹ìQƒeüV‹ðEüPÿuèþYY…Àtƒ}ütÿuüPÿu è þÿÿƒÄ …Àt3À@ë3À^ÉÃU‹ììSV‹ð‹Ï…øýÿÿè'‹Èè(þÿÿ3ÛS…øýÿÿPÿVWÿV8] uWÿu‹Æè~ÿÿÿYY‹Øë €} u5SWÿuÿWÿV(3ۃøÿ‹Ï•Ãèªþÿÿƒûu9]u WÿV(ƒÈPWÿV,3À@ë3À^[ÉÃU‹ìƒìSVWèsüÿÿ‹ø…ÿ„"h"¿ŠWèÌüÿÿ‹ØYY…Û„ jh0h„jÿӋð…ö„ñh¼Û«½W‰~`‰^@è•üÿÿhÒ¼‰W‰F$è‡üÿÿh|QgjW‰F(èyüÿÿhëI”W‰F,èküÿÿh•å©—W‰F0è]üÿÿh¥°(W‰F4èOüÿÿh)·W‰F8èAüÿÿh[uŠðW‰FDè3üÿÿƒÄ@‹Øhd†óuW‰^ è üÿÿh¢¦aëW‰F èüÿÿhÕOd"W‰Fèüÿÿhy.ÔW‰Fèöûÿÿh±÷W‰FèèûÿÿheóW÷W‰FèÚûÿÿh¯4P“W‰FèÌûÿÿh{=#W‰F<è¾ûÿÿƒÄ@hOû~ W‰Fè­ûÿÿhà=!6W‰FHèŸûÿÿhh‰#W‰è’ûÿÿ‰FLhÍeWè„ûÿÿhÓ1ÆVW‰FPèvûÿÿh7œ½W‰FTèhûÿÿh£-ãW‰FXèZûÿÿ‰F\ƒÄ8EðPÇEðshelÇEôl32ÿӋø…ÿt"hÀåz°W‰~dè,ûÿÿhêêºW‰FlèûÿÿƒÄ‰FpEøPÇEøuserfÇEü32ÆEþÿV ‹ø…ÿtAhqV°0W‰~hèìúÿÿhkV°0W‰FxèÞúÿÿh&cj—W‰FtèÐúÿÿh<cj—W‰F|èÂúÿÿƒÄ ‰†€‹Æë3À_^[ÉÃU‹ìƒì\V‹uW3ÿ;÷„îSè¤ýÿÿ‹Ø;ßu WÿDéՍ†‰EüPëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPF‰Eø‰E9>tYÿ¶¶ŽQP¾ ‹Ãè¾üÿÿ‰}3ÿƒÄ 9>t1jDE¤WPèjEèWPèüƒÄEèPE¤PWWj WWWWÿuÿS$9¾(t†lP†,Pÿu‹Ãè½úÿÿƒÄ 9¾tëj2ÿSPÿuüWWÿSL…ÀuïjdÿSPÿuøÿSWÿSD[_3À^ÉÂU‹ìƒì SW3ÿWWjWjh€ÿu‰}øÿV‹Øƒûÿu3Àë>WSÿV‰Eô;Çt+jh0PWÿV@‰Eø;ÇtWMüQÿuô‰}üPSÿV‹Eü‹M ‰SÿV‹Eø_[É÷f‰f…ÒtV‹ð+ñƒÁ·f‰f…Òuñ^ÃU‹ìQQ‹E‰Eü‹EüE‰Eø‹Eü;Eøt‹EüŠM ˆ‹Eü@‰Eüëç‹EÉÃfƒ8V‹ðt ƒÆfƒ>u÷+ò· f‰ ƒÂf…Éuñ^ËD$Š@„Éuù+D$HÅÉu3ÀÃfƒ9‹Át ƒÀfƒ8u÷+ÁÑøÅÉt èÚÿÿÿ…ÀtDAþë fƒù\t ƒè·f…Éuï3ÀÃ
process_handle: 0x00000114
base_address: 0x000b0000
success 1 0
1619303304.3415
WriteProcessMemory
process_identifier: 648
buffer: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\274b8be4390840eef16ac73f4e62b878.exe"C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\274b8be4390840eef16ac73f4e62b878.exe" itsowneset bpXSVCTIKURC = creaTeoBject("WSCrIPt.shell") BpxsVctikurC.run """%ls""", 0, False
process_handle: 0x00000114
base_address: 0x000c0000
success 1 0
1619303304.5445
CreateProcessInternalW
thread_identifier: 1632
thread_handle: 0x0000011c
process_identifier: 2440
current_directory:
filepath:
track: 1
command_line: "C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\274b8be4390840eef16ac73f4e62b878.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
process_handle: 0x00000118
inherit_handles: 0
success 1 0
1619303304.5445
NtUnmapViewOfSection
process_identifier: 2440
region_size: 4096
process_handle: 0x00000118
base_address: 0x00400000
success 0 0
1619303304.5755
NtMapViewOfSection
section_handle: 0x00000124
process_identifier: 2440
commit_size: 786432
win32_protect: 64 (PAGE_EXECUTE_READWRITE)
buffer:
process_handle: 0x00000118
allocation_type: 0 ()
section_offset: 0
view_size: 786432
base_address: 0x00400000
success 0 0
1619303304.6225
NtGetContextThread
thread_handle: 0x0000011c
success 0 0
1619303304.6225
NtSetContextThread
thread_handle: 0x0000011c
registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4972688
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
process_identifier: 2440
success 0 0
1619303305.4035
NtResumeThread
thread_handle: 0x0000011c
suspend_count: 1
process_identifier: 2440
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:
• 0x47c150 VirtualFree
• 0x47c154 VirtualAlloc
• 0x47c158 LocalFree
• 0x47c15c LocalAlloc
• 0x47c160 GetVersion
• 0x47c164 GetCurrentThreadId
• 0x47c170 VirtualQuery
• 0x47c174 WideCharToMultiByte
• 0x47c17c MultiByteToWideChar
• 0x47c180 lstrlenA
• 0x47c184 lstrcpynA
• 0x47c188 LoadLibraryExA
• 0x47c18c GetThreadLocale
• 0x47c190 GetStartupInfoA
• 0x47c194 GetProcAddress
• 0x47c198 GetModuleHandleA
• 0x47c19c GetModuleFileNameA
• 0x47c1a0 GetLocaleInfoA
• 0x47c1a4 GetLastError
• 0x47c1ac GetCommandLineA
• 0x47c1b0 FreeLibrary
• 0x47c1b4 FindFirstFileA
• 0x47c1b8 FindClose
• 0x47c1bc ExitProcess
• 0x47c1c0 WriteFile
• 0x47c1c8 RtlUnwind
• 0x47c1cc RaiseException
• 0x47c1d0 GetStdHandle
Library user32.dll:
• 0x47c1d8 GetKeyboardType
• 0x47c1dc LoadStringA
• 0x47c1e0 MessageBoxA
• 0x47c1e4 CharNextA
Library advapi32.dll:
• 0x47c1ec RegQueryValueExA
• 0x47c1f0 RegOpenKeyExA
• 0x47c1f4 RegCloseKey
Library oleaut32.dll:
• 0x47c1fc SysFreeString
• 0x47c200 SysReAllocStringLen
• 0x47c204 SysAllocStringLen
Library kernel32.dll:
• 0x47c20c TlsSetValue
• 0x47c210 TlsGetValue
• 0x47c214 LocalAlloc
• 0x47c218 GetModuleHandleA
Library advapi32.dll:
• 0x47c220 RegQueryValueExA
• 0x47c224 RegOpenKeyExA
• 0x47c228 RegCloseKey
Library kernel32.dll:
• 0x47c230 lstrcpyA
• 0x47c234 WriteFile
• 0x47c238 WaitForSingleObject
• 0x47c23c VirtualQuery
• 0x47c240 VirtualProtect
• 0x47c244 VirtualAlloc
• 0x47c248 Sleep
• 0x47c24c SizeofResource
• 0x47c250 SetThreadLocale
• 0x47c254 SetFilePointer
• 0x47c258 SetEvent
• 0x47c25c SetErrorMode
• 0x47c260 SetEndOfFile
• 0x47c264 ResetEvent
• 0x47c268 ReadFile
• 0x47c26c MulDiv
• 0x47c270 LockResource
• 0x47c274 LoadResource
• 0x47c278 LoadLibraryA
• 0x47c284 GlobalUnlock
• 0x47c288 GlobalReAlloc
• 0x47c28c GlobalHandle
• 0x47c290 GlobalLock
• 0x47c294 GlobalFree
• 0x47c298 GlobalFindAtomA
• 0x47c29c GlobalDeleteAtom
• 0x47c2a0 GlobalAlloc
• 0x47c2a4 GlobalAddAtomA
• 0x47c2ac GetVersionExA
• 0x47c2b0 GetVersion
• 0x47c2b4 GetTickCount
• 0x47c2b8 GetThreadLocale
• 0x47c2c0 GetSystemInfo
• 0x47c2c4 GetStringTypeExA
• 0x47c2c8 GetStdHandle
• 0x47c2cc GetProcAddress
• 0x47c2d0 GetModuleHandleA
• 0x47c2d4 GetModuleFileNameA
• 0x47c2d8 GetLogicalDrives
• 0x47c2dc GetLocaleInfoA
• 0x47c2e0 GetLocalTime
• 0x47c2e4 GetLastError
• 0x47c2e8 GetFullPathNameA
• 0x47c2ec GetFileAttributesA
• 0x47c2f0 GetDriveTypeA
• 0x47c2f4 GetDiskFreeSpaceA
• 0x47c2f8 GetDateFormatA
• 0x47c2fc GetCurrentThreadId
• 0x47c300 GetCurrentProcessId
• 0x47c304 GetCPInfo
• 0x47c308 GetACP
• 0x47c30c FreeResource
• 0x47c310 InterlockedExchange
• 0x47c314 FreeLibrary
• 0x47c318 FormatMessageA
• 0x47c31c FindResourceA
• 0x47c320 FindNextFileA
• 0x47c324 FindFirstFileA
• 0x47c328 FindClose
• 0x47c338 EnumCalendarInfoA
• 0x47c344 CreateThread
• 0x47c348 CreateFileA
• 0x47c34c CreateEventA
• 0x47c350 CompareStringA
• 0x47c354 CloseHandle
Library mpr.dll:
• 0x47c35c WNetGetConnectionA
Library version.dll:
• 0x47c364 VerQueryValueA
• 0x47c36c GetFileVersionInfoA
Library gdi32.dll:
• 0x47c374 UnrealizeObject
• 0x47c378 StretchBlt
• 0x47c37c SetWindowOrgEx
• 0x47c380 SetWinMetaFileBits
• 0x47c384 SetViewportOrgEx
• 0x47c388 SetTextColor
• 0x47c38c SetStretchBltMode
• 0x47c390 SetROP2
• 0x47c394 SetPixel
• 0x47c398 SetEnhMetaFileBits
• 0x47c39c SetDIBColorTable
• 0x47c3a0 SetBrushOrgEx
• 0x47c3a4 SetBkMode
• 0x47c3a8 SetBkColor
• 0x47c3ac SelectPalette
• 0x47c3b0 SelectObject
• 0x47c3b4 SaveDC
• 0x47c3b8 RoundRect
• 0x47c3bc RestoreDC
• 0x47c3c0 Rectangle
• 0x47c3c4 RectVisible
• 0x47c3c8 RealizePalette
• 0x47c3cc PlayEnhMetaFile
• 0x47c3d0 PatBlt
• 0x47c3d4 MoveToEx
• 0x47c3d8 MaskBlt
• 0x47c3dc LineTo
• 0x47c3e0 IntersectClipRect
• 0x47c3e4 GetWindowOrgEx
• 0x47c3e8 GetWinMetaFileBits
• 0x47c3ec GetTextMetricsA
• 0x47c3f8 GetStockObject
• 0x47c3fc GetPixel
• 0x47c400 GetPaletteEntries
• 0x47c404 GetObjectA
• 0x47c410 GetEnhMetaFileBits
• 0x47c414 GetDeviceCaps
• 0x47c418 GetDIBits
• 0x47c41c GetDIBColorTable
• 0x47c420 GetDCOrgEx
• 0x47c428 GetClipBox
• 0x47c42c GetBrushOrgEx
• 0x47c430 GetBitmapBits
• 0x47c434 ExtTextOutA
• 0x47c438 ExcludeClipRect
• 0x47c43c Ellipse
• 0x47c440 DeleteObject
• 0x47c444 DeleteEnhMetaFile
• 0x47c448 DeleteDC
• 0x47c44c CreateSolidBrush
• 0x47c450 CreatePenIndirect
• 0x47c454 CreatePalette
• 0x47c45c CreateFontIndirectA
• 0x47c460 CreateDIBitmap
• 0x47c464 CreateDIBSection
• 0x47c468 CreateCompatibleDC
• 0x47c470 CreateBrushIndirect
• 0x47c474 CreateBitmap
• 0x47c478 CopyEnhMetaFileA
• 0x47c47c BitBlt
Library opengl32.dll:
• 0x47c484 wglDeleteContext
Library user32.dll:
• 0x47c48c CreateWindowExA
• 0x47c490 WindowFromPoint
• 0x47c494 WinHelpA
• 0x47c498 WaitMessage
• 0x47c49c UpdateWindow
• 0x47c4a0 UnregisterClassA
• 0x47c4a4 UnhookWindowsHookEx
• 0x47c4a8 TranslateMessage
• 0x47c4b0 TrackPopupMenu
• 0x47c4b8 ShowWindow
• 0x47c4bc ShowScrollBar
• 0x47c4c0 ShowOwnedPopups
• 0x47c4c4 ShowCursor
• 0x47c4c8 SetWindowsHookExA
• 0x47c4cc SetWindowTextA
• 0x47c4d0 SetWindowPos
• 0x47c4d4 SetWindowPlacement
• 0x47c4d8 SetWindowLongA
• 0x47c4dc SetTimer
• 0x47c4e0 SetScrollRange
• 0x47c4e4 SetScrollPos
• 0x47c4e8 SetScrollInfo
• 0x47c4ec SetRect
• 0x47c4f0 SetPropA
• 0x47c4f4 SetParent
• 0x47c4f8 SetMenuItemInfoA
• 0x47c4fc SetMenu
• 0x47c500 SetKeyboardState
• 0x47c504 SetForegroundWindow
• 0x47c508 SetFocus
• 0x47c50c SetCursor
• 0x47c510 SetClipboardData
• 0x47c514 SetClassLongA
• 0x47c518 SetCapture
• 0x47c51c SetActiveWindow
• 0x47c520 SendMessageA
• 0x47c524 ScrollWindow
• 0x47c528 ScreenToClient
• 0x47c52c RemovePropA
• 0x47c530 RemoveMenu
• 0x47c534 ReleaseDC
• 0x47c538 ReleaseCapture
• 0x47c544 RegisterClassA
• 0x47c548 RedrawWindow
• 0x47c54c PtInRect
• 0x47c550 PostQuitMessage
• 0x47c554 PostMessageA
• 0x47c558 PeekMessageA
• 0x47c55c OpenClipboard
• 0x47c560 OffsetRect
• 0x47c564 OemToCharA
• 0x47c568 MessageBoxA
• 0x47c56c MessageBeep
• 0x47c570 MapWindowPoints
• 0x47c574 MapVirtualKeyA
• 0x47c578 LoadStringA
• 0x47c57c LoadKeyboardLayoutA
• 0x47c580 LoadIconA
• 0x47c584 LoadCursorA
• 0x47c588 LoadBitmapA
• 0x47c58c KillTimer
• 0x47c590 IsZoomed
• 0x47c594 IsWindowVisible
• 0x47c598 IsWindowEnabled
• 0x47c59c IsWindow
• 0x47c5a0 IsRectEmpty
• 0x47c5a4 IsIconic
• 0x47c5a8 IsDialogMessageA
• 0x47c5ac IsChild
• 0x47c5b0 IsCharAlphaNumericA
• 0x47c5b4 IsCharAlphaA
• 0x47c5b8 InvalidateRect
• 0x47c5bc IntersectRect
• 0x47c5c0 InsertMenuItemA
• 0x47c5c4 InsertMenuA
• 0x47c5c8 InflateRect
• 0x47c5d0 GetWindowTextA
• 0x47c5d4 GetWindowRect
• 0x47c5d8 GetWindowPlacement
• 0x47c5dc GetWindowLongA
• 0x47c5e0 GetWindowDC
• 0x47c5e4 GetTopWindow
• 0x47c5e8 GetSystemMetrics
• 0x47c5ec GetSystemMenu
• 0x47c5f0 GetSysColorBrush
• 0x47c5f4 GetSysColor
• 0x47c5f8 GetSubMenu
• 0x47c5fc GetScrollRange
• 0x47c600 GetScrollPos
• 0x47c604 GetScrollInfo
• 0x47c608 GetPropA
• 0x47c60c GetParent
• 0x47c610 GetWindow
• 0x47c614 GetMenuStringA
• 0x47c618 GetMenuState
• 0x47c61c GetMenuItemInfoA
• 0x47c620 GetMenuItemID
• 0x47c624 GetMenuItemCount
• 0x47c628 GetMenu
• 0x47c62c GetLastActivePopup
• 0x47c630 GetKeyboardState
• 0x47c638 GetKeyboardLayout
• 0x47c63c GetKeyState
• 0x47c640 GetKeyNameTextA
• 0x47c644 GetIconInfo
• 0x47c648 GetForegroundWindow
• 0x47c64c GetFocus
• 0x47c650 GetDesktopWindow
• 0x47c654 GetDCEx
• 0x47c658 GetDC
• 0x47c65c GetCursorPos
• 0x47c660 GetCursor
• 0x47c664 GetClipboardData
• 0x47c668 GetClientRect
• 0x47c66c GetClassNameA
• 0x47c670 GetClassInfoA
• 0x47c674 GetCapture
• 0x47c678 GetActiveWindow
• 0x47c67c FrameRect
• 0x47c680 FindWindowA
• 0x47c684 FillRect
• 0x47c688 EqualRect
• 0x47c68c EnumWindows
• 0x47c690 EnumThreadWindows
• 0x47c698 EndPaint
• 0x47c69c EnableWindow
• 0x47c6a0 EnableScrollBar
• 0x47c6a4 EnableMenuItem
• 0x47c6a8 EmptyClipboard
• 0x47c6ac DrawTextA
• 0x47c6b0 DrawMenuBar
• 0x47c6b4 DrawIconEx
• 0x47c6b8 DrawIcon
• 0x47c6bc DrawFrameControl
• 0x47c6c0 DrawFocusRect
• 0x47c6c4 DrawEdge
• 0x47c6c8 DispatchMessageA
• 0x47c6cc DestroyWindow
• 0x47c6d0 DestroyMenu
• 0x47c6d4 DestroyIcon
• 0x47c6d8 DestroyCursor
• 0x47c6dc DeleteMenu
• 0x47c6e0 DefWindowProcA
• 0x47c6e4 DefMDIChildProcA
• 0x47c6e8 DefFrameProcA
• 0x47c6ec CreatePopupMenu
• 0x47c6f0 CreateMenu
• 0x47c6f4 CreateIcon
• 0x47c6f8 CloseClipboard
• 0x47c6fc ClientToScreen
• 0x47c700 CheckMenuItem
• 0x47c704 CallWindowProcA
• 0x47c708 CallNextHookEx
• 0x47c70c BeginPaint
• 0x47c710 CharNextA
• 0x47c714 CharLowerBuffA
• 0x47c718 CharLowerA
• 0x47c71c CharUpperBuffA
• 0x47c720 CharToOemA
• 0x47c724 AdjustWindowRectEx
Library kernel32.dll:
• 0x47c730 Sleep
Library oleaut32.dll:
• 0x47c738 SafeArrayPtrOfIndex
• 0x47c73c SafeArrayGetUBound
• 0x47c740 SafeArrayGetLBound
• 0x47c744 SafeArrayCreate
• 0x47c748 VariantChangeType
• 0x47c74c VariantCopy
• 0x47c750 VariantClear
• 0x47c754 VariantInit
Library comctl32.dll:
• 0x47c764 ImageList_Write
• 0x47c768 ImageList_Read
• 0x47c778 ImageList_DragMove
• 0x47c77c ImageList_DragLeave
• 0x47c780 ImageList_DragEnter
• 0x47c784 ImageList_EndDrag
• 0x47c788 ImageList_BeginDrag
• 0x47c78c ImageList_Remove
• 0x47c790 ImageList_DrawEx
• 0x47c794 ImageList_Replace
• 0x47c798 ImageList_Draw
• 0x47c7a8 ImageList_Add
• 0x47c7b0 ImageList_Destroy
• 0x47c7b4 ImageList_Create

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 51811 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62192 239.255.255.250 3702
192.168.56.101 51808 8.8.8.8 53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.