SmartHawk

9.4

极危

40 个模型检测该样本为恶意！

重新分析

下载样本

b1b92692a2a1461aa0b29f17be351cf336138400aaf581d42c4e1c2c63d1aaac

37c23dcb6a9c22558148d566c5d36c7d.exe

分析耗时

130s

最近分析

文件大小

2.6MB

静态报毒动态报毒 A VARIANT OF GENERIK ACAEW ADWAREFILETOUR ARTEMIS AUTOIT ENBO FNGVAP GENERICKD KPOT LMBA QVM42 R02CC0DHH19 ROYJD SKEEYAH UNSAFE YVXLGM 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!37C23DCB6A9C	20190925	6.0.6.653
Alibaba	Trojan:Win32/Autoit.5aba224e	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:Malware-gen	20190925	18.4.3895.0
Tencent	Win32.Trojan.Autoit.Lmba	20190926	1.0.0.1
Kingsoft		20190926	2013.8.14.323
CrowdStrike		20190702	1.0

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619363357.944375 GetComputerNameA	computer_name: OSKAR-PC	success	1	0
1619363385.817047 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (31 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345033.638379 IsDebuggerPresent		failed	0	0
1619362965.181519 IsDebuggerPresent		failed	0	0
1619362965.259519 IsDebuggerPresent		failed	0	0
1619362966.056519 IsDebuggerPresent		failed	0	0
1619362966.072519 IsDebuggerPresent		failed	0	0
1619362966.072519 IsDebuggerPresent		failed	0	0
1619362966.072519 IsDebuggerPresent		failed	0	0
1619362966.072519 IsDebuggerPresent		failed	0	0
1619362966.087519 IsDebuggerPresent		failed	0	0
1619362966.087519 IsDebuggerPresent		failed	0	0
1619362966.103519 IsDebuggerPresent		failed	0	0
1619362967.572519 IsDebuggerPresent		failed	0	0
1619362969.040519 IsDebuggerPresent		failed	0	0
1619362974.431519 IsDebuggerPresent		failed	0	0
1619362974.775519 IsDebuggerPresent		failed	0	0
1619362974.884519 IsDebuggerPresent		failed	0	0
1619362975.072519 IsDebuggerPresent		failed	0	0
1619362976.634519 IsDebuggerPresent		failed	0	0
1619362977.697519 IsDebuggerPresent		failed	0	0
1619362980.603519 IsDebuggerPresent		failed	0	0
1619362982.618519 IsDebuggerPresent		failed	0	0
1619362983.009519 IsDebuggerPresent		failed	0	0
1619362941.759394 IsDebuggerPresent		failed	0	0
1619362942.947394 IsDebuggerPresent		failed	0	0
1619362933.697769 IsDebuggerPresent		failed	0	0
1619362933.759769 IsDebuggerPresent		failed	0	0
1619362933.962769 IsDebuggerPresent		failed	0	0
1619363371.426047 IsDebuggerPresent		failed	0	0
1619362962.278951 IsDebuggerPresent		failed	0	0
1619362962.278951 IsDebuggerPresent		failed	0	0
1619362962.340951 IsDebuggerPresent		failed	0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 个事件)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 个事件)

file	C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome.dll

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619363359.881375 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 个事件)

section	CODE
section	DATA
section	BSS

One or more processes crashed (3 个事件)

Time & API	Arguments	Status
1619362987.556519 __exception__	stacktrace: 0xb82e04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 registers.r14: 5555309956608 registers.r9: 0 registers.rcx: 1356 registers.rsi: -6148914691236517206 registers.r10: 0 registers.rbx: 255651328 registers.rdi: 17302540 registers.r11: 255655248 registers.r8: 2009563532 registers.rdx: 1404 registers.rbp: 255651184 registers.r15: 255651688 registers.r12: 255652088 registers.rsp: 255651048 registers.rax: 12070400 registers.r13: 5555310952448 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 a3 77 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb82e04	success
1619363371.270047 __exception__	stacktrace: DebugConnect+0x1280ea dbgeng+0x20f01f @ 0x7294f01f DebugConnect+0xd2165 dbgeng+0x1b909a @ 0x728f909a DebugConnect+0x517b3 dbgeng+0x1386e8 @ 0x728786e8 DebugConnect+0x42e2 dbgeng+0xeb217 @ 0x7282b217 DebugConnect+0x453a dbgeng+0xeb46f @ 0x7282b46f DebugConnect+0x4720 dbgeng+0xeb655 @ 0x7282b655 onreturn+0x184e4 @ 0x4184e4 onreturn+0x1023d @ 0x41023d onreturn+0x18063 @ 0x418063 onreturn+0x6965 @ 0x406965 onreturn+0x170e0 @ 0x4170e0 onreturn+0x192fe @ 0x4192fe onreturn+0x1fe22 @ 0x41fe22 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1636740 registers.edi: 1637320 registers.eax: 1636772 registers.ebp: 1636788 registers.edx: 2130566132 registers.ebx: 1637352 registers.esi: 32578496 registers.ecx: 100073472 exception.instruction_r: 0f c7 c8 01 00 5b c7 45 e4 01 00 00 00 eb 07 33 exception.symbol: DebugConnect+0x11f7c5 dbgeng+0x2066fa exception.address: 0x729466fa exception.module: dbgeng.dll exception.exception_code: 0xc000001d exception.offset: 2123514	success
1619363373.301047 __exception__	stacktrace: lineCreateAgentW+0x99 lineCreateAgentA-0xde tapi32+0x74c3 @ 0x744574c3 onreturn+0x4e27 @ 0x404e27 registers.esp: 1633912 registers.edi: 1634060 registers.eax: 0 registers.ebp: 1633960 registers.edx: 575976 registers.ebx: 0 registers.esi: 0 registers.ecx: 0 exception.instruction_r: ff 01 8b 11 4a 89 11 eb 2e 8b 45 ec 8b 00 8b 00 exception.symbol: GetTapi16CallbackMsg-0xa49 tapi32+0x37cb exception.instruction: inc dword ptr [ecx] exception.module: TAPI32.dll exception.exception_code: 0xc0000005 exception.offset: 14283 exception.address: 0x744537cb	success

Allocates read-write-execute memory (usually to unpack itself) (6 个事件)

Time & API	Arguments	Status
1619345033.529379 NtProtectVirtualMemory	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619345033.529379 NtProtectVirtualMemory	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 45056 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00401000	success
1619345033.529379 NtProtectVirtualMemory	process_identifier: 884 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00410000	success
1619363353.100375 NtAllocateVirtualMemory	process_identifier: 2236 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00610000	success
1619363379.942047 NtAllocateVirtualMemory	process_identifier: 3636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x04760000	success
1619363384.238047 NtAllocateVirtualMemory	process_identifier: 3636 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x05960000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

An application raised an exception which may be indicative of an exploit crash (2 个事件)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process chrome.exe with pid 1880 crashed
1619362987.556519 __exception__	stacktrace: 0xb82e04 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 0x30 registers.r14: 5555309956608 registers.r9: 0 registers.rcx: 1356 registers.rsi: -6148914691236517206 registers.r10: 0 registers.rbx: 255651328 registers.rdi: 17302540 registers.r11: 255655248 registers.r8: 2009563532 registers.rdx: 1404 registers.rbp: 255651184 registers.r15: 255651688 registers.r12: 255652088 registers.rsp: 255651048 registers.rax: 12070400 registers.r13: 5555310952448 exception.instruction_r: ff 15 16 1f 09 00 ff 25 00 00 00 00 aa a4 a3 77 exception.instruction: call qword ptr [rip + 0x91f16] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xb82e04	success	0	0

Steals private information from local Internet browsers (24 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\reports
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\BrowserMetrics-spare.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6085738A-758.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\BrowserMetrics
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad\metadata
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\First Run
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Last Version
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-spare.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma~RF16fb443.TMP
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Default\Policy\User Policy
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index

Creates executable files on the filesystem (2 个事件)

file	C:\Program Files (x86)\Margin Trade\Margin\MarginTrade\Onreturn.exe
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MarginTrade\MarginTrade.lnk

Creates a shortcut to an executable file (4 个事件)

file	C:\Users\Administrator.Oskar-PC\Links\Desktop.lnk
file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MarginTrade\MarginTrade.lnk
file	C:\Users\Administrator.Oskar-PC\Links\Downloads.lnk
file	C:\Users\Administrator.Oskar-PC\Links\RecentPlaces.lnk

Creates a suspicious process (1 个事件)

cmdline

"cmd.exe" /c "start https://iplogger.org/1tagu7"

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\is-P73TN.tmp\37c23dcb6a9c22558148d566c5d36c7d.tmp

Queries for potentially installed applications (4 个事件)

Time & API	Arguments	Status	Return
1619363353.912375 RegOpenKeyExA	access: 0x00000001 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{185623589-5865-4F66-B722-EE1C7FDA0836}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{185623589-5865-4F66-B722-EE1C7FDA0836}_is1 options: 0	failed	2
1619363353.912375 RegOpenKeyExA	access: 0x00000001 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{185623589-5865-4F66-B722-EE1C7FDA0836}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{185623589-5865-4F66-B722-EE1C7FDA0836}_is1 options: 0	failed	2
1619363358.803375 RegOpenKeyExA	access: 0x00000008 base_handle: 0x80000001 key_handle: 0x00000000 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{185623589-5865-4F66-B722-EE1C7FDA0836}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{185623589-5865-4F66-B722-EE1C7FDA0836}_is1 options: 0	failed	2
1619363358.803375 RegOpenKeyExA	access: 0x00000008 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{185623589-5865-4F66-B722-EE1C7FDA0836}_is1 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{185623589-5865-4F66-B722-EE1C7FDA0836}_is1 options: 0	failed	2

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619362965.275519 SetWindowsHookExW	thread_identifier: 0 callback_function: 0x00000000ff35ae10 module_address: 0x00000000ff2b0000 hook_identifier: 13 (WH_KEYBOARD_LL)	success	787319	0

One or more non-safelisted processes were created (3 个事件)

parent_process	chrome.exe	martian_process	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1020,13973197417247507720,7089304885613938264,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1096 /prefetch:2
parent_process	chrome.exe	martian_process	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xb0,0xb4,0xb8,0x84,0xbc,0x7fef26e4f50,0x7fef26e4f60,0x7fef26e4f70
parent_process	chrome.exe	martian_process	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Administrator.Oskar-PC\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xac,0xb0,0xb4,0x80,0xb8,0x7fef26e4f50,0x7fef26e4f60,0x7fef26e4f70

Resumed a suspended thread in a remote process potentially indicative of process injection (7 个事件)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3244 resumed a thread in remote process 1880
1619362990.481951 NtResumeThread	thread_handle: 0x000000000000010c suspend_count: 2 process_identifier: 1880	success	0	0
1619362991.481951 NtResumeThread	thread_handle: 0x000000000000010c suspend_count: 2 process_identifier: 1880	success	0	0
1619362992.246951 NtResumeThread	thread_handle: 0x000000000000010c suspend_count: 2 process_identifier: 1880	success	0	0
1619362992.809951 NtResumeThread	thread_handle: 0x000000000000010c suspend_count: 2 process_identifier: 1880	success	0	0
1619362994.434951 NtResumeThread	thread_handle: 0x000000000000010c suspend_count: 2 process_identifier: 1880	success	0	0
1619362995.184951 NtResumeThread	thread_handle: 0x000000000000010c suspend_count: 2 process_identifier: 1880	success	0	0

Generates some ICMP traffic

File has been identified by 40 AntiVirus engines on VirusTotal as malicious (40 个事件)

MicroWorld-eScan	Trojan.GenericKD.41582910
CAT-QuickHeal	Trojan.Autoit
McAfee	Artemis!37C23DCB6A9C
Malwarebytes	Trojan.Downloader
K7AntiVirus	Trojan ( 005560ce1 )
Alibaba	Trojan:Win32/Autoit.5aba224e
K7GW	Trojan ( 005560ce1 )
Arcabit	Trojan.Generic.D27A813E
TrendMicro	TROJ_GEN.R02CC0DHH19
Symantec	Trojan.Gen.MBT
Avast	Win32:Malware-gen
ClamAV	Win.Dropper.Kpot-7130024-0
Kaspersky	Trojan.Win32.Autoit.acaew
BitDefender	Trojan.GenericKD.41582910
NANO-Antivirus	Trojan.Win32.Autoit.fngvap
AegisLab	Trojan.Multi.Generic.4!c
Tencent	Win32.Trojan.Autoit.Lmba
Emsisoft	Trojan.GenericKD.41582910 (B)
F-Secure	Trojan.TR/PSW.Stealer.royjd
DrWeb	Trojan.PWS.Stealer.26735
McAfee-GW-Edition	BehavesLike.Win32.AdwareFileTour.vc
FireEye	Trojan.GenericKD.41582910
Sophos	Mal/Generic-S
Cyren	W32/Trojan.ENBO-9219
Webroot	W32.Adware.Gen
Avira	TR/PSW.Stealer.royjd
Microsoft	Trojan:Win32/Skeeyah.G!MTB
ZoneAlarm	Trojan.Win32.Autoit.acaew
GData	Trojan.GenericKD.41582910
AhnLab-V3	Malware/Win32.Generic.C3372348
VBA32	Trojan.Autoit
ALYac	Trojan.GenericKD.41582910
Cylance	Unsafe
ESET-NOD32	a variant of Generik.YVXLGM
TrendMicro-HouseCall	TROJ_GEN.R02CC0DHH19
Ikarus	Trojan.Autoit
Fortinet	W32/Autoit.ACAEW!tr
AVG	Win32:Malware-gen
Panda	Trj/CI.A
Qihoo-360	HEUR/QVM42.3.3531.Malware.Gen

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x40e0b4 DeleteCriticalSection

• 0x40e0b8 LeaveCriticalSection

• 0x40e0bc EnterCriticalSection

• 0x40e0c0 InitializeCriticalSection

• 0x40e0c4 VirtualFree

• 0x40e0c8 VirtualAlloc

• 0x40e0cc LocalFree

• 0x40e0d0 LocalAlloc

• 0x40e0d4 WideCharToMultiByte

• 0x40e0d8 TlsSetValue

• 0x40e0dc TlsGetValue

• 0x40e0e0 MultiByteToWideChar

• 0x40e0e4 GetModuleHandleA

• 0x40e0e8 GetLastError

• 0x40e0ec GetCommandLineA

• 0x40e0f0 WriteFile

• 0x40e0f4 SetFilePointer

• 0x40e0f8 SetEndOfFile

• 0x40e0fc RtlUnwind

• 0x40e100 ReadFile

• 0x40e104 RaiseException

• 0x40e108 GetStdHandle

• 0x40e10c GetFileSize

• 0x40e110 GetSystemTime

• 0x40e114 GetFileType

• 0x40e118 ExitProcess

• 0x40e11c CreateFileA

• 0x40e120 CloseHandle

Library user32.dll:

• 0x40e128 MessageBoxA

Library oleaut32.dll:

• 0x40e130 VariantChangeTypeEx

• 0x40e134 VariantCopyInd

• 0x40e138 VariantClear

• 0x40e13c SysStringLen

• 0x40e140 SysAllocStringLen

Library advapi32.dll:

• 0x40e148 RegQueryValueExA

• 0x40e14c RegOpenKeyExA

• 0x40e150 RegCloseKey

• 0x40e154 OpenProcessToken

• 0x40e158 LookupPrivilegeValueA

Library kernel32.dll:

• 0x40e160 WriteFile

• 0x40e164 VirtualQuery

• 0x40e168 VirtualProtect

• 0x40e16c VirtualFree

• 0x40e170 VirtualAlloc

• 0x40e174 Sleep

• 0x40e178 SizeofResource

• 0x40e17c SetLastError

• 0x40e180 SetFilePointer

• 0x40e184 SetErrorMode

• 0x40e188 SetEndOfFile

• 0x40e18c RemoveDirectoryA

• 0x40e190 ReadFile

• 0x40e194 LockResource

• 0x40e198 LoadResource

• 0x40e19c LoadLibraryA

• 0x40e1a0 IsDBCSLeadByte

• 0x40e1a4 GetWindowsDirectoryA

• 0x40e1a8 GetVersionExA

• 0x40e1ac GetVersion

• 0x40e1b0 GetUserDefaultLangID

• 0x40e1b4 GetSystemInfo

• 0x40e1b8 GetSystemDirectoryA

• 0x40e1bc GetSystemDefaultLCID

• 0x40e1c0 GetProcAddress

• 0x40e1c4 GetModuleHandleA

• 0x40e1c8 GetModuleFileNameA

• 0x40e1cc GetLocaleInfoA

• 0x40e1d0 GetLastError

• 0x40e1d4 GetFullPathNameA

• 0x40e1d8 GetFileSize

• 0x40e1dc GetFileAttributesA

• 0x40e1e0 GetExitCodeProcess

• 0x40e1e4 GetEnvironmentVariableA

• 0x40e1e8 GetCurrentProcess

• 0x40e1ec GetCommandLineA

• 0x40e1f0 GetACP

• 0x40e1f4 InterlockedExchange

• 0x40e1f8 FormatMessageA

• 0x40e1fc FindResourceA

• 0x40e200 DeleteFileA

• 0x40e204 CreateProcessA

• 0x40e208 CreateFileA

• 0x40e20c CreateDirectoryA

• 0x40e210 CloseHandle

Library user32.dll:

• 0x40e218 TranslateMessage

• 0x40e21c SetWindowLongA

• 0x40e220 PeekMessageA

• 0x40e224 MsgWaitForMultipleObjects

• 0x40e228 MessageBoxA

• 0x40e22c LoadStringA

• 0x40e230 ExitWindowsEx

• 0x40e234 DispatchMessageA

• 0x40e238 DestroyWindow

• 0x40e23c CreateWindowExA

• 0x40e240 CallWindowProcA

• 0x40e244 CharPrevA

Library comctl32.dll:

• 0x40e24c InitCommonControls

Library advapi32.dll:

• 0x40e254 AdjustTokenPrivileges

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.