SmartHawk

2.2

中危

该样本未表现出任何异常！

e5d3a7159b8e4fe10969342e05e09c645898145f760eeb250430cc4e20455131

2e2a0f510b9d187390be08f134bc5118.exe

分析耗时

110s

最近分析

文件大小

2.7MB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

This executable is signed

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1983-02-08 22:14:04

Imports

Library KERNEL32.dll:

• 0x6ac4bc GetModuleHandleA

• 0x6ac4c0 GetModuleFileNameA

• 0x6ac4c4 QueryPerformanceCounter

• 0x6ac4c8 GetProcAddress

• 0x6ac4cc QueryPerformanceFrequency

• 0x6ac4d0 LoadLibraryA

• 0x6ac4d4 EnumSystemLocalesW

• 0x6ac4d8 lstrcat

• 0x6ac4dc ReadFile

• 0x6ac4e0 WritePrivateProfileStructA

• 0x6ac4e4 InitializeCriticalSectionAndSpinCount

• 0x6ac4e8 GetModuleHandleW

• 0x6ac4ec VirtualAllocEx

• 0x6ac4f0 GetLastError

• 0x6ac4f4 Sleep

Library USER32.dll:

• 0x6ac4fc HideCaret

• 0x6ac500 InsertMenuItemW

• 0x6ac504 GetCursor

• 0x6ac508 IMPGetIMEW

• 0x6ac50c BroadcastSystemMessageA

• 0x6ac510 RemoveMenu

• 0x6ac514 DrawIcon

• 0x6ac518 LoadIconA

• 0x6ac51c GetAsyncKeyState

• 0x6ac520 WindowFromDC

• 0x6ac524 GetClipboardData

• 0x6ac528 ReleaseCapture

• 0x6ac52c IsCharLowerA

• 0x6ac530 GetInputState

• 0x6ac534 GetThreadDesktop

• 0x6ac538 DestroyWindow

• 0x6ac53c GetListBoxInfo

• 0x6ac540 GetTopWindow

• 0x6ac544 CharNextA

• 0x6ac548 EndMenu

• 0x6ac54c CloseDesktop

• 0x6ac550 GetDlgCtrlID

Library GDI32.dll:

• 0x6ac558 GetCharABCWidthsFloatA

• 0x6ac55c EngDeleteSurface

• 0x6ac560 GdiEntry15

• 0x6ac564 XLATEOBJ_piVector

• 0x6ac568 EnumFontFamiliesA

• 0x6ac56c CreateMetaFileA

• 0x6ac570 FONTOBJ_pxoGetXform

• 0x6ac574 GetGlyphOutlineWow

• 0x6ac578 DrawEscape

• 0x6ac57c PATHOBJ_bEnum

• 0x6ac580 ChoosePixelFormat

• 0x6ac584 GetWindowExtEx

• 0x6ac588 GdiDllInitialize

• 0x6ac58c GetStockObject

• 0x6ac590 GetEnhMetaFileW

• 0x6ac594 GetDCBrushColor

• 0x6ac598 GetDCPenColor

• 0x6ac59c CloseFigure

• 0x6ac5a0 CreateCompatibleDC

• 0x6ac5a4 GetMapMode

• 0x6ac5a8 PathToRegion

• 0x6ac5ac SetMetaRgn

• 0x6ac5b0 GetTextCharacterExtra

• 0x6ac5b4 GetStretchBltMode

• 0x6ac5b8 GetPixelFormat

• 0x6ac5bc GetSystemPaletteUse

• 0x6ac5c0 DeleteMetaFile

Library ADVAPI32.dll:

• 0x6ac5c8 RegOpenKeyExA

• 0x6ac5cc RegQueryValueExA

• 0x6ac5d0 RegCloseKey

• 0x6ac5d4 RegOpenKeyW

• 0x6ac5d8 GetUserNameA

Library SHELL32.dll:

• 0x6ac5e0 ShellExecuteEx

• 0x6ac5e4 SHGetSpecialFolderPathA

• 0x6ac5e8 SHFreeNameMappings

• 0x6ac5ec DuplicateIcon

• 0x6ac5f0 ShellExecuteW

• 0x6ac5f4 DragQueryFileW

• 0x6ac5f8 ExtractAssociatedIconExW

• 0x6ac5fc SHBrowseForFolderA

• 0x6ac600 SHFileOperationA

• 0x6ac604 CommandLineToArgvW

• 0x6ac608 ShellAboutW

• 0x6ac60c ShellHookProc

• 0x6ac610 CheckEscapesW

• 0x6ac614 SHQueryRecycleBinW

• 0x6ac618 SHFileOperationW

• 0x6ac61c SHBrowseForFolder

• 0x6ac620 ShellExecuteExA

• 0x6ac624 Shell_NotifyIcon

• 0x6ac628 DragQueryFileAorW

• 0x6ac62c SHGetFileInfoA

• 0x6ac630 SHGetFileInfoW

• 0x6ac634 SHCreateDirectoryExW

• 0x6ac638 SHGetFolderLocation

• 0x6ac63c SHQueryRecycleBinA

• 0x6ac640 SHInvokePrinterCommandW

• 0x6ac644 SHBindToParent

• 0x6ac648 SHGetPathFromIDListA

• 0x6ac64c DoEnvironmentSubstA

Library SHLWAPI.dll:

• 0x6ac654 StrChrIW

• 0x6ac658 StrStrA

• 0x6ac65c StrChrA

• 0x6ac660 StrStrIW

• 0x6ac664 StrChrIA

• 0x6ac668 StrCmpNA

• 0x6ac66c StrRChrA

• 0x6ac670 StrRChrIA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.24.14
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60221	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.