SmartHawk

1.6

低危

该样本未表现出任何异常！

重新分析

下载样本

595c3b3ebe38bff868b4666ef70cfb96dc7bce436fa27ffeacfca979cb35c1c7

35aad46fe3032fa1a3cde1cde58d483e.exe

分析耗时

18s

最近分析

文件大小

249.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345037.219046 __exception__	stacktrace: registers.esp: 1638252 registers.edi: 4935680 registers.eax: 9823512 registers.ebp: 4294682953 registers.edx: 4637183 registers.ebx: 136 registers.esi: 4198400 registers.ecx: 1618 exception.instruction_r: 8a 07 47 2c e8 3c 01 77 f7 80 3f 24 75 f2 8b 07 exception.symbol: 35aad46fe3032fa1a3cde1cde58d483e+0xb27a2 exception.instruction: mov al, byte ptr [edi] exception.module: 35aad46fe3032fa1a3cde1cde58d483e.exe exception.exception_code: 0xc0000005 exception.offset: 731042 exception.address: 0x4b27a2	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.921274357959719

section

{'size_of_data': '0x0003ca00', 'virtual_address': '0x00076000', 'entropy': 7.921274357959719, 'name': 'UPX1', 'virtual_size': '0x0003d000'}

description

A section with a high entropy has been found

entropy

0.9778225806451613

description

Overall entropy of this PE file is high

The executable is compressed using UPX (2 个事件)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2012-01-16 00:49:40

Imports

Library KERNEL32.DLL:

• 0x4b41ac LoadLibraryA

• 0x4b41b0 GetProcAddress

• 0x4b41b4 VirtualProtect

• 0x4b41b8 VirtualAlloc

• 0x4b41bc VirtualFree

• 0x4b41c0 ExitProcess

Library advapi32.dll:

• 0x4b41c8 IsValidSid

Library AVICAP32.DLL:

• 0x4b41d0 capGetDriverDescriptionA

Library comctl32.dll:

• 0x4b41d8 ImageList_Add

Library gdi32.dll:

• 0x4b41e0 SaveDC

Library gdiplus.dll:

• 0x4b41e8 GdipFree

Library msacm32.dll:

• 0x4b41f0 acmStreamSize

Library netapi32.dll:

• 0x4b41f8 Netbios

Library ntdll:

• 0x4b4200 NtUnmapViewOfSection

Library ntdll.dll:

• 0x4b4208 NtQuerySystemInformation

Library ole32.dll:

• 0x4b4210 IsEqualGUID

Library oleaut32.dll:

• 0x4b4218 VariantCopy

Library shell32.dll:

• 0x4b4220 ShellExecuteA

Library SHFolder.dll:

• 0x4b4228 SHGetFolderPathA

Library URLMON.DLL:

• 0x4b4230 URLDownloadToFileA

Library user32.dll:

• 0x4b4238 GetDC

Library version.dll:

• 0x4b4240 VerQueryValueA

Library wininet.dll:

• 0x4b4248 FtpPutFileA

Library winmm.dll:

• 0x4b4250 waveInOpen

Library WS2_32.DLL:

• 0x4b4258 WSAIoctl

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.