1.0
低危
该样本未表现出任何异常！
重新分析
更多

0538714e31a9f18e71e5570927f3b7d8e1b8eba23a2fdcd4c26d022720841efd

37cf630a657c9432c117f5d8340f3d88.exe

分析耗时

26s

最近分析

文件大小

1021.5KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20201224 6.0.6.653
Baidu 20190318 1.0.0.2
Avast 20201224 21.1.5827.0
Alibaba 20190527 0.3.0.5
Tencent 20201224 1.0.0.1
Kingsoft 20201224 2017.9.26.565
CrowdStrike 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)
section .itext
section .didata
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1620752124.055751
__exception__
stacktrace: 
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1638284
registers.edi: 0
registers.eax: 1983198136
registers.ebp: 1638292
registers.edx: 4939500
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
exception.instruction_r: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
exception.symbol: TMethodImplementationIntercept+0x61e94 dbkFCallWrapperAddr-0x8750 37cf630a657c9432c117f5d8340f3d88+0xb5eec
exception.instruction: add byte ptr [eax], al
exception.module: 37cf630a657c9432c117f5d8340f3d88.exe
exception.exception_code: 0xc0000005
exception.offset: 745196
exception.address: 0x4b5eec
success 0 0
行为判定
动态指标
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-21 13:56:23

Imports

Library kernel32.dll:
• 0x4c22e4 GetACP
• 0x4c22e8 GetExitCodeProcess
• 0x4c22ec LocalFree
• 0x4c22f0 CloseHandle
• 0x4c22f4 SizeofResource
• 0x4c22f8 VirtualProtect
• 0x4c22fc VirtualFree
• 0x4c2300 GetFullPathNameW
• 0x4c2304 ExitProcess
• 0x4c2308 HeapAlloc
• 0x4c230c GetCPInfoExW
• 0x4c2310 RtlUnwind
• 0x4c2314 GetCPInfo
• 0x4c2318 GetStdHandle
• 0x4c231c GetModuleHandleW
• 0x4c2320 FreeLibrary
• 0x4c2324 HeapDestroy
• 0x4c2328 ReadFile
• 0x4c232c CreateProcessW
• 0x4c2330 GetLastError
• 0x4c2334 GetModuleFileNameW
• 0x4c2338 SetLastError
• 0x4c233c FindResourceW
• 0x4c2340 CreateThread
• 0x4c2344 CompareStringW
• 0x4c2348 LoadLibraryA
• 0x4c234c ResetEvent
• 0x4c2350 GetVersion
• 0x4c2354 RaiseException
• 0x4c2358 FormatMessageW
• 0x4c235c SwitchToThread
• 0x4c2360 GetExitCodeThread
• 0x4c2364 GetCurrentThread
• 0x4c2368 LoadLibraryExW
• 0x4c236c LockResource
• 0x4c2370 GetCurrentThreadId
• 0x4c2378 VirtualQuery
• 0x4c237c VirtualQueryEx
• 0x4c2380 Sleep
• 0x4c2388 SetFilePointer
• 0x4c238c LoadResource
• 0x4c2390 SuspendThread
• 0x4c2394 GetTickCount
• 0x4c2398 GetFileSize
• 0x4c239c GetStartupInfoW
• 0x4c23a0 GetFileAttributesW
• 0x4c23a8 GetThreadPriority
• 0x4c23ac SetThreadPriority
• 0x4c23b0 GetCurrentProcess
• 0x4c23b4 VirtualAlloc
• 0x4c23b8 GetSystemInfo
• 0x4c23bc GetCommandLineW
• 0x4c23c4 GetProcAddress
• 0x4c23c8 ResumeThread
• 0x4c23cc GetVersionExW
• 0x4c23d0 VerifyVersionInfoW
• 0x4c23d4 HeapCreate
• 0x4c23dc VerSetConditionMask
• 0x4c23e0 GetDiskFreeSpaceW
• 0x4c23e4 FindFirstFileW
• 0x4c23ec lstrlenW
• 0x4c23f4 SetEndOfFile
• 0x4c23f8 HeapFree
• 0x4c23fc WideCharToMultiByte
• 0x4c2400 FindClose
• 0x4c2404 MultiByteToWideChar
• 0x4c2408 LoadLibraryW
• 0x4c240c SetEvent
• 0x4c2410 CreateFileW
• 0x4c2414 GetLocaleInfoW
• 0x4c2418 GetSystemDirectoryW
• 0x4c241c DeleteFileW
• 0x4c2420 GetLocalTime
• 0x4c2428 WaitForSingleObject
• 0x4c242c WriteFile
• 0x4c2430 ExitThread
• 0x4c2438 TlsGetValue
• 0x4c243c GetDateFormatW
• 0x4c2440 SetErrorMode
• 0x4c2444 IsValidLocale
• 0x4c2448 TlsSetValue
• 0x4c244c CreateDirectoryW
• 0x4c2454 EnumCalendarInfoW
• 0x4c2458 LocalAlloc
• 0x4c2460 RemoveDirectoryW
• 0x4c2464 CreateEventW
• 0x4c2468 SetThreadLocale
• 0x4c246c GetThreadLocale
Library comctl32.dll:
• 0x4c2474 InitCommonControls
Library version.dll:
• 0x4c2480 VerQueryValueW
• 0x4c2484 GetFileVersionInfoW
Library user32.dll:
• 0x4c248c CreateWindowExW
• 0x4c2490 TranslateMessage
• 0x4c2494 CharLowerBuffW
• 0x4c2498 CallWindowProcW
• 0x4c249c CharUpperW
• 0x4c24a0 PeekMessageW
• 0x4c24a4 GetSystemMetrics
• 0x4c24a8 SetWindowLongW
• 0x4c24ac MessageBoxW
• 0x4c24b0 DestroyWindow
• 0x4c24b4 CharUpperBuffW
• 0x4c24b8 CharNextW
• 0x4c24c0 LoadStringW
• 0x4c24c4 ExitWindowsEx
• 0x4c24c8 DispatchMessageW
Library oleaut32.dll:
• 0x4c24d0 SysAllocStringLen
• 0x4c24d4 SafeArrayPtrOfIndex
• 0x4c24d8 VariantCopy
• 0x4c24dc SafeArrayGetLBound
• 0x4c24e0 SafeArrayGetUBound
• 0x4c24e4 VariantInit
• 0x4c24e8 VariantClear
• 0x4c24ec SysFreeString
• 0x4c24f0 SysReAllocStringLen
• 0x4c24f4 VariantChangeType
• 0x4c24f8 SafeArrayCreate
Library netapi32.dll:
• 0x4c2500 NetWkstaGetInfo
• 0x4c2504 NetApiBufferFree
Library advapi32.dll:
• 0x4c250c RegQueryValueExW
• 0x4c2518 RegCloseKey
• 0x4c251c OpenProcessToken
• 0x4c2520 RegOpenKeyExW

Exports

Ordinal Address Name
3 0x454058 TMethodImplementationIntercept
2 0x40d0a0 __dbk_fcall_wrapper
1 0x4be63c dbkFCallWrapperAddr

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702
192.168.56.101 51809 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.