SmartHawk

2.0

低危

该样本未表现出任何异常！

a35b2e1c380b51a165a00b146c7365228964c7399fc7aa9758a003d1421597d4

2d1432211dcd33e83ddd780e4863f716.exe

分析耗时

95s

最近分析

文件大小

2.4MB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-05-28 01:23:34

Imports

Library KERNEL32.dll:

• 0x47d000 Sleep

• 0x47d004 VirtualAlloc

• 0x47d008 FreeConsole

• 0x47d00c WriteConsoleW

• 0x47d010 GetLastError

• 0x47d014 FormatMessageW

• 0x47d018 WideCharToMultiByte

• 0x47d01c EnterCriticalSection

• 0x47d020 LeaveCriticalSection

• 0x47d024 DeleteCriticalSection

• 0x47d028 MultiByteToWideChar

• 0x47d02c EncodePointer

• 0x47d030 DecodePointer

• 0x47d034 SetLastError

• 0x47d038 InitializeCriticalSectionAndSpinCount

• 0x47d03c CreateEventW

• 0x47d040 SwitchToThread

• 0x47d044 TlsAlloc

• 0x47d048 TlsGetValue

• 0x47d04c TlsSetValue

• 0x47d050 TlsFree

• 0x47d054 GetSystemTimeAsFileTime

• 0x47d058 GetTickCount

• 0x47d05c GetModuleHandleW

• 0x47d060 GetProcAddress

• 0x47d064 CompareStringW

• 0x47d068 LCMapStringW

• 0x47d06c GetLocaleInfoW

• 0x47d070 GetStringTypeW

• 0x47d074 GetCPInfo

• 0x47d078 UnhandledExceptionFilter

• 0x47d07c SetUnhandledExceptionFilter

• 0x47d080 GetCurrentProcess

• 0x47d084 TerminateProcess

• 0x47d088 IsProcessorFeaturePresent

• 0x47d08c QueryPerformanceCounter

• 0x47d090 GetCurrentProcessId

• 0x47d094 GetCurrentThreadId

• 0x47d098 InitializeSListHead

• 0x47d09c IsDebuggerPresent

• 0x47d0a0 GetStartupInfoW

• 0x47d0a4 RaiseException

• 0x47d0a8 RtlUnwind

• 0x47d0ac InterlockedPushEntrySList

• 0x47d0b0 InterlockedFlushSList

• 0x47d0b4 FreeLibrary

• 0x47d0b8 LoadLibraryExW

• 0x47d0bc GetStdHandle

• 0x47d0c0 WriteFile

• 0x47d0c4 GetModuleFileNameW

• 0x47d0c8 ExitProcess

• 0x47d0cc GetModuleHandleExW

• 0x47d0d0 GetCommandLineA

• 0x47d0d4 GetCommandLineW

• 0x47d0d8 GetCurrentThread

• 0x47d0dc HeapFree

• 0x47d0e0 CloseHandle

• 0x47d0e4 WaitForSingleObject

• 0x47d0e8 GetExitCodeProcess

• 0x47d0ec CreateProcessW

• 0x47d0f0 GetFileAttributesExW

• 0x47d0f4 HeapAlloc

• 0x47d0f8 GetDateFormatW

• 0x47d0fc GetTimeFormatW

• 0x47d100 IsValidLocale

• 0x47d104 GetUserDefaultLCID

• 0x47d108 EnumSystemLocalesW

• 0x47d10c GetFileType

• 0x47d110 FlushFileBuffers

• 0x47d114 GetConsoleCP

• 0x47d118 GetConsoleMode

• 0x47d11c ReadFile

• 0x47d120 GetFileSizeEx

• 0x47d124 SetFilePointerEx

• 0x47d128 ReadConsoleW

• 0x47d12c HeapReAlloc

• 0x47d130 SetConsoleCtrlHandler

• 0x47d134 GetTimeZoneInformation

• 0x47d138 OutputDebugStringW

• 0x47d13c FindClose

• 0x47d140 FindFirstFileExW

• 0x47d144 FindNextFileW

• 0x47d148 IsValidCodePage

• 0x47d14c GetACP

• 0x47d150 GetOEMCP

• 0x47d154 GetEnvironmentStringsW

• 0x47d158 FreeEnvironmentStringsW

• 0x47d15c SetEnvironmentVariableW

• 0x47d160 SetStdHandle

• 0x47d164 GetProcessHeap

• 0x47d168 CreateFileW

• 0x47d16c HeapSize

• 0x47d170 SetEndOfFile

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.24.14
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.