5.8
高危
3 个模型检测该样本为恶意！
重新分析
更多

8f8967c423c9de661296e1d822ab06a38c25ec7d508303ac11750bc21a87363c

3118f2881662a05205346c548d3cb281.exe

分析耗时

92s

最近分析

文件大小

749.9KB
静态报毒 动态报毒 CONFIDENCE HIGH NQ1@AG7FYFAI SCORE ZEXACO3
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20191112 6.0.6.653
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast 20191113 18.4.3895.0
Tencent 20191113 1.0.0.1
Kingsoft 20191113 2013.8.14.323
CrowdStrike win/malicious_confidence_80% (D) 20190702 1.0
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1620728217.22725
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1620728217.22725
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
This executable is signed
This executable has a PDB path (1 个事件)
pdb_path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1620728214.13425
GlobalMemoryStatusEx
success 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)
section .gfids
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (1 个事件)
Time & API Arguments Status Return Repeated
1620727855.777271
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004060000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)
Time & API Arguments Status Return Repeated
1620727792.043271
GetDiskFreeSpaceExW
root_path: C:\Users\Administrator.Oskar-PC\AppData\Local\Microsoft\Windows\Explorer
free_bytes_available: 19475722240
total_number_of_free_bytes: 0
total_number_of_bytes: 0
success 1 0
Creates executable files on the filesystem (4 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\PartyPokerSetup.exe_Installer\SmartInstaller.exe
file C:\Users\Administrator.Oskar-PC\Desktop\partypoker installieren.lnk
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\PartyPokerSetup.exe_Installer\zlib.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\PartyPokerSetup.exe_Installer\SIInvoker.exe
Creates a shortcut to an executable file (11 个事件)
file C:\Users\Administrator.Oskar-PC\Desktop\Instalar partypoker.lnk
file C:\Users\Administrator.Oskar-PC\Desktop\partypoker telepítése.lnk
file C:\Users\Administrator.Oskar-PC\Desktop\partypoker installieren.lnk
file C:\Users\Public\Desktop\Google Chrome.lnk
file C:\Users\Administrator.Oskar-PC\Desktop\Установить partypoker.lnk
file C:\Users\Administrator.Oskar-PC\Desktop\Installera partypoker.lnk
file C:\Users\Administrator.Oskar-PC\Desktop\Instalacja oprogramowania partypoker.lnk
file C:\Users\Administrator.Oskar-PC\Desktop\Εγκατάσταση του partypoker.lnk
file C:\Users\Administrator.Oskar-PC\Desktop\Installer partypoker.lnk
file C:\Users\Administrator.Oskar-PC\Desktop\Instalare partypoker.lnk
file C:\Users\Administrator.Oskar-PC\Desktop\Install partypoker.lnk
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\PartyPokerSetup.exe_Installer\SmartInstaller.exe
Drops an executable to the user AppData folder (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\PartyPokerSetup.exe_Installer\SmartInstaller.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\PartyPokerSetup.exe_Installer\zlib.dll
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\PartyPokerSetup.exe_Installer\SIInvoker.exe
File has been identified by 3 AntiVirus engines on VirusTotal as malicious (3 个事件)
BitDefenderTheta Gen:NN.ZexaCO3.32248.nq1@aG7Fyfai
Trapmine malicious.high.ml.score
CrowdStrike win/malicious_confidence_80% (D)
Queries for potentially installed applications (2 个事件)
Time & API Arguments Status Return Repeated
1620728214.35225
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x00000000
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\PartyCasino
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\PartyCasino
options: 0
failed 2 0
1620728214.38425
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x00000000
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\PartyPoker
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\PartyPoker
options: 0
failed 2 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2017-08-11 21:54:06

Imports

Library KERNEL32.dll:
• 0x430000 GetLastError
• 0x430004 SetLastError
• 0x430008 GetCurrentProcess
• 0x43000c DeviceIoControl
• 0x430010 SetFileTime
• 0x430014 CloseHandle
• 0x430018 CreateDirectoryW
• 0x43001c RemoveDirectoryW
• 0x430020 CreateFileW
• 0x430024 DeleteFileW
• 0x430028 CreateHardLinkW
• 0x43002c GetShortPathNameW
• 0x430030 GetLongPathNameW
• 0x430034 MoveFileW
• 0x430038 GetFileType
• 0x43003c GetStdHandle
• 0x430040 WriteFile
• 0x430044 ReadFile
• 0x430048 FlushFileBuffers
• 0x43004c SetEndOfFile
• 0x430050 SetFilePointer
• 0x430054 SetFileAttributesW
• 0x430058 GetFileAttributesW
• 0x43005c FindClose
• 0x430060 FindFirstFileW
• 0x430064 FindNextFileW
• 0x430068 GetVersionExW
• 0x430070 GetFullPathNameW
• 0x430074 FoldStringW
• 0x430078 GetModuleFileNameW
• 0x43007c GetModuleHandleW
• 0x430080 FindResourceW
• 0x430084 FreeLibrary
• 0x430088 GetProcAddress
• 0x43008c GetCurrentProcessId
• 0x430090 ExitProcess
• 0x430098 Sleep
• 0x43009c LoadLibraryW
• 0x4300a0 GetSystemDirectoryW
• 0x4300a4 CompareStringW
• 0x4300a8 AllocConsole
• 0x4300ac FreeConsole
• 0x4300b0 AttachConsole
• 0x4300b4 WriteConsoleW
• 0x4300bc CreateThread
• 0x4300c0 SetThreadPriority
• 0x4300d4 SetEvent
• 0x4300d8 ResetEvent
• 0x4300dc ReleaseSemaphore
• 0x4300e0 WaitForSingleObject
• 0x4300e4 CreateEventW
• 0x4300e8 CreateSemaphoreW
• 0x4300ec GetSystemTime
• 0x430108 GetCPInfo
• 0x43010c IsDBCSLeadByte
• 0x430110 MultiByteToWideChar
• 0x430114 WideCharToMultiByte
• 0x430118 GlobalAlloc
• 0x43011c GetTickCount
• 0x430124 GetExitCodeProcess
• 0x430128 GetLocalTime
• 0x43012c MapViewOfFile
• 0x430130 UnmapViewOfFile
• 0x430134 CreateFileMappingW
• 0x430138 OpenFileMappingW
• 0x43013c GetCommandLineW
• 0x430148 GetTempPathW
• 0x43014c MoveFileExW
• 0x430150 GetLocaleInfoW
• 0x430154 GetTimeFormatW
• 0x430158 GetDateFormatW
• 0x43015c GetNumberFormatW
• 0x430160 RaiseException
• 0x430164 GetSystemInfo
• 0x430168 VirtualProtect
• 0x43016c VirtualQuery
• 0x430170 LoadLibraryExA
• 0x430178 IsDebuggerPresent
• 0x430184 GetStartupInfoW
• 0x43018c GetCurrentThreadId
• 0x430194 InitializeSListHead
• 0x430198 TerminateProcess
• 0x43019c RtlUnwind
• 0x4301a0 EncodePointer
• 0x4301a8 TlsAlloc
• 0x4301ac TlsGetValue
• 0x4301b0 TlsSetValue
• 0x4301b4 TlsFree
• 0x4301b8 LoadLibraryExW
• 0x4301c0 GetModuleHandleExW
• 0x4301c4 GetModuleFileNameA
• 0x4301c8 GetACP
• 0x4301cc HeapFree
• 0x4301d0 HeapAlloc
• 0x4301d4 HeapReAlloc
• 0x4301d8 GetStringTypeW
• 0x4301dc LCMapStringW
• 0x4301e0 FindFirstFileExA
• 0x4301e4 FindNextFileA
• 0x4301e8 IsValidCodePage
• 0x4301ec GetOEMCP
• 0x4301f0 GetCommandLineA
• 0x4301fc GetProcessHeap
• 0x430200 SetStdHandle
• 0x430204 HeapSize
• 0x430208 GetConsoleCP
• 0x43020c GetConsoleMode
• 0x430210 SetFilePointerEx
• 0x430214 DecodePointer

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.