SmartHawk

3.4

中危

该样本未表现出任何异常！

重新分析

下载样本

fa8bb8aade3749fb3338d7cd35c9e07781a5422aed193f85e5a3bc1b2fd02c1f

304438334c506b404a5ab35d81c53577.exe

分析耗时

146s

最近分析

文件大小

2.7MB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Command line console output was observed (29 个事件)

Time & API	Arguments	Status	Return
1619380180.165001 WriteConsoleW	buffer: 另一个程序正在使用此文件，进程无法访问。 console_handle: 0x0000000b	success	1
1619380171.431751 WriteConsoleA	buffer: ÕýÔÚ Ping 127.0.0.1 console_handle: 0x00000007	success	1
1619380171.572751 WriteConsoleA	buffer: ¾ßÓÐ 32 ×Ö½ÚµÄÊý¾Ý: console_handle: 0x00000007	success	1
1619380171.712751 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619380171.712751 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619380171.712751 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619380171.712751 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619380172.712751 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619380172.712751 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619380172.712751 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619380172.712751 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619380173.712751 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619380173.712751 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619380173.712751 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619380173.712751 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619380174.712751 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619380174.712751 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619380174.712751 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619380174.712751 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619380175.712751 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619380175.712751 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619380175.712751 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619380175.712751 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619380176.712751 WriteConsoleA	buffer: À´×Ô 127.0.0.1 µÄ»Ø¸´: console_handle: 0x00000007	success	1
1619380176.712751 WriteConsoleA	buffer: ×Ö½Ú=32 console_handle: 0x00000007	success	1
1619380176.712751 WriteConsoleA	buffer: Ê±¼ä<1ms console_handle: 0x00000007	success	1
1619380176.712751 WriteConsoleA	buffer: TTL=128 console_handle: 0x00000007	success	1
1619380177.040751 WriteConsoleA	buffer: 127.0.0.1 µÄ Ping Í³¼ÆÐÅÏ¢: Êý¾Ý°ü: ÒÑ·¢ËÍ = 6£¬ÒÑ½ÓÊÕ = 6£¬¶ªÊ§ = 0 (0% ¶ªÊ§)£¬ console_handle: 0x00000007	success	1
1619380177.118751 WriteConsoleA	buffer: Íù·µÐÐ³ÌµÄ¹À¼ÆÊ±¼ä(ÒÔºÁÃëÎªµ¥Î»): ×î¶Ì = 0ms£¬×î³¤ = 0ms£¬Æ½¾ù = 0ms console_handle: 0x00000007	success	1

This executable is signed

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619380171.134751 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.data2

Uses Windows utilities for basic Windows functionality (1 个事件)

cmdline

ping.exe -n 6 127.0.0.1

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	216.58.200.238:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1982-07-31 18:53:08

Imports

Library KERNEL32.dll:

• 0x6ad00c EnumSystemLocalesW

• 0x6ad010 lstrcat

• 0x6ad014 ReadFile

• 0x6ad018 WritePrivateProfileStructA

• 0x6ad01c InitializeCriticalSectionAndSpinCount

• 0x6ad020 GetModuleHandleW

• 0x6ad024 VirtualAllocEx

• 0x6ad028 GetLastError

• 0x6ad02c Sleep

Library USER32.dll:

• 0x6ad034 DrawIcon

• 0x6ad038 LoadIconA

• 0x6ad03c IsClipboardFormatAvailable

• 0x6ad040 WindowFromDC

• 0x6ad044 GetClipboardData

• 0x6ad048 ReleaseCapture

• 0x6ad04c IsCharLowerA

• 0x6ad050 GetInputState

• 0x6ad054 GetThreadDesktop

• 0x6ad058 DestroyWindow

• 0x6ad05c GetListBoxInfo

• 0x6ad060 GetTopWindow

• 0x6ad064 CharNextA

• 0x6ad068 EndMenu

• 0x6ad06c CloseDesktop

• 0x6ad070 GetDlgCtrlID

Library GDI32.dll:

• 0x6ad078 GetStockObject

• 0x6ad07c GetEnhMetaFileW

• 0x6ad080 GetDCBrushColor

• 0x6ad084 GetDCPenColor

• 0x6ad088 CloseFigure

• 0x6ad08c CreateCompatibleDC

• 0x6ad090 GetMapMode

• 0x6ad094 PathToRegion

• 0x6ad098 SetMetaRgn

• 0x6ad09c GetTextCharacterExtra

• 0x6ad0a0 GetStretchBltMode

• 0x6ad0a4 GetPixelFormat

• 0x6ad0a8 GetSystemPaletteUse

• 0x6ad0ac DeleteMetaFile

Library ADVAPI32.dll:

• 0x6ad0b4 RegOpenKeyExA

• 0x6ad0b8 RegQueryValueExA

• 0x6ad0bc RegCloseKey

• 0x6ad0c0 RegOpenKeyW

Library SHELL32.dll:

• 0x6ad0c8 ShellExecuteEx

• 0x6ad0cc SHGetSpecialFolderPathA

• 0x6ad0d0 SHFreeNameMappings

• 0x6ad0d4 DuplicateIcon

• 0x6ad0d8 ShellExecuteW

• 0x6ad0dc DragQueryFileW

• 0x6ad0e0 ExtractAssociatedIconExW

• 0x6ad0e4 SHBrowseForFolderA

• 0x6ad0e8 SHFileOperationA

• 0x6ad0ec CommandLineToArgvW

• 0x6ad0f0 ShellAboutW

• 0x6ad0f4 ShellHookProc

• 0x6ad0f8 CheckEscapesW

• 0x6ad0fc SHQueryRecycleBinW

• 0x6ad100 SHFileOperationW

• 0x6ad104 SHBrowseForFolder

• 0x6ad108 ShellExecuteExA

• 0x6ad10c Shell_NotifyIcon

• 0x6ad110 DragQueryFileAorW

• 0x6ad114 SHGetFileInfoA

• 0x6ad118 SHGetFileInfoW

• 0x6ad11c SHCreateDirectoryExW

• 0x6ad120 SHGetFolderLocation

• 0x6ad124 SHQueryRecycleBinA

• 0x6ad128 SHInvokePrinterCommandW

• 0x6ad12c SHBindToParent

• 0x6ad130 SHGetPathFromIDListA

• 0x6ad134 DoEnvironmentSubstA

Library SHLWAPI.dll:

• 0x6ad13c StrChrIW

• 0x6ad140 StrStrA

• 0x6ad144 StrChrA

• 0x6ad148 StrStrIW

• 0x6ad14c StrChrIA

• 0x6ad150 StrCmpNA

• 0x6ad154 StrRChrA

• 0x6ad158 StrRChrIA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com A 216.58.200.238	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60221	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.