SmartHawk

2.4

中危

该样本未表现出任何异常！

重新分析

下载样本

a368d2407396335c753ebb7c54f3d2722226c78446dc546d816e016a9cbb51f1

2e5e92bdddf8fd7b1c263dcd8c853b09.exe

分析耗时

23s

最近分析

文件大小

469.4KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

This executable is signed

This executable has a PDB path (1 个事件)

pdb_path

D:\Build\isafe\branches\RF6.3\bin\YACcleaner.pdb

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

PKGRES

Foreign language identified in PE resource (4 个事件)

name

PKGRES

language

LANG_CHINESE

offset

0x00020db8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00050ee2

name

RT_ICON

language

LANG_CHINESE

offset

0x00010190

filetype

dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00010828

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x000209b8

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000014

name

RT_VERSION

language

LANG_CHINESE

offset

0x000209d0

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000003e4

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.366168546765961

section

{'size_of_data': '0x00062000', 'virtual_address': '0x00010000', 'entropy': 7.366168546765961, 'name': '.rsrc', 'virtual_size': '0x00061e28'}

description

A section with a high entropy has been found

entropy

0.875

description

Overall entropy of this PE file is high

Queries for potentially installed applications (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620759723.286126 RegOpenKeyExW	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iSafe regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\iSafe options: 0	failed	2	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2016-03-30 18:30:55

Imports

Library KERNEL32.dll:

• 0x408000 GetModuleFileNameW

• 0x408004 lstrlenW

• 0x408008 SetDllDirectoryW

• 0x40800c LoadLibraryExW

• 0x408010 GetProcAddress

• 0x408014 InitializeCriticalSectionAndSpinCount

• 0x408018 CloseHandle

• 0x40801c WriteConsoleW

• 0x408020 SetFilePointerEx

• 0x408024 SetStdHandle

• 0x408028 GetConsoleMode

• 0x40802c GetConsoleCP

• 0x408030 FlushFileBuffers

• 0x408034 LCMapStringW

• 0x408038 GetCommandLineW

• 0x40803c GetLastError

• 0x408040 HeapFree

• 0x408044 IsDebuggerPresent

• 0x408048 IsProcessorFeaturePresent

• 0x40804c SetLastError

• 0x408050 InterlockedIncrement

• 0x408054 InterlockedDecrement

• 0x408058 GetCurrentThreadId

• 0x40805c EncodePointer

• 0x408060 DecodePointer

• 0x408064 ExitProcess

• 0x408068 GetModuleHandleExW

• 0x40806c MultiByteToWideChar

• 0x408070 GetStdHandle

• 0x408074 WriteFile

• 0x408078 GetProcessHeap

• 0x40807c GetFileType

• 0x408080 DeleteCriticalSection

• 0x408084 GetStartupInfoW

• 0x408088 QueryPerformanceCounter

• 0x40808c GetCurrentProcessId

• 0x408090 GetSystemTimeAsFileTime

• 0x408094 GetEnvironmentStringsW

• 0x408098 FreeEnvironmentStringsW

• 0x40809c UnhandledExceptionFilter

• 0x4080a0 SetUnhandledExceptionFilter

• 0x4080a4 GetCurrentProcess

• 0x4080a8 TerminateProcess

• 0x4080ac TlsAlloc

• 0x4080b0 TlsGetValue

• 0x4080b4 TlsSetValue

• 0x4080b8 TlsFree

• 0x4080bc GetModuleHandleW

• 0x4080c0 EnterCriticalSection

• 0x4080c4 LeaveCriticalSection

• 0x4080c8 Sleep

• 0x4080cc IsValidCodePage

• 0x4080d0 GetACP

• 0x4080d4 GetOEMCP

• 0x4080d8 GetCPInfo

• 0x4080dc OutputDebugStringW

• 0x4080e0 LoadLibraryW

• 0x4080e4 RtlUnwind

• 0x4080e8 HeapAlloc

• 0x4080ec HeapReAlloc

• 0x4080f0 WideCharToMultiByte

• 0x4080f4 GetStringTypeW

• 0x4080f8 HeapSize

• 0x4080fc CreateFileW

Library SHELL32.dll:

• 0x408104 ShellExecuteW

• 0x408108

Library ole32.dll:

• 0x40812c CoUninitialize

• 0x408130 CoInitialize

Library SHLWAPI.dll:

• 0x408110 PathFindFileNameW

• 0x408114 PathAddBackslashW

• 0x408118 PathFileExistsW

• 0x40811c SHGetValueW

• 0x408120 StrCmpNIW

• 0x408124 PathAppendW

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62319	239.255.255.250	3702
192.168.56.101	63432	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.