SmartHawk

5.0

中危

该样本未表现出任何异常！

重新分析

下载样本

fba9479271348e06f166c681e91a9489e5d89d560ee4a14a2664b956b444ab3a

39b8625ff243041deb1cdad3f584c0b3.exe

分析耗时

76s

最近分析

文件大小

108.1KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345046.225269 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (5 个事件)

Time & API	Arguments	Status	Return
1619345037.975269 CryptGenKey	crypto_handle: 0x00621960 algorithm_identifier: 0x0000660e () provider_handle: 0x00579e08 flags: 1 key: ffÂ48:âÝg0ä;	success	1
1619345046.240269 CryptExportKey	crypto_handle: 0x00621960 crypto_export_handle: 0x00579d90 buffer: f¤¶Fæ¶%Á^U`)·rH«Ôúê{¡.wV´&C(Ðßþºöø¸ãrG}&$Ä?MGÖcÙÌ¤ËJó^SDä"ð¢(f1¤wpü&ëæê« blob_type: 1 flags: 64	success	1
1619345081.615269 CryptExportKey	crypto_handle: 0x00621960 crypto_export_handle: 0x00579d90 buffer: f¤h@Ò7¦·è1 [¼ëºÑµãó¡ ïÕl=(&À±ÉiÕX}àåÞî\|&mùyMï_À/å¹ÓÛº¥ßIÅìá W2d'f/¹æw blob_type: 1 flags: 64	success	1
1619345087.443269 CryptExportKey	crypto_handle: 0x00621960 crypto_export_handle: 0x00579d90 buffer: f¤%®ÐÞA¢æ$3XâÇ ¤»yÄhAVwÁ¬G _¢¯£TMiêEÏý Õ tdß#¦ªè.ºòíÖÁáC_;/áTé¥Ï¨{²@Ôîf+¤<Þ9±d¢zB blob_type: 1 flags: 64	success	1
1619345093.365269 CryptExportKey	crypto_handle: 0x00621960 crypto_export_handle: 0x00579d90 buffer: f¤ñ²û#´=áÿ¹Û®Çz¯×tR"sy÷ÿoî$¸}Ö/µlÉ¢Åüÿ²ß±ÕRLÍ<u\AÊòÔ*DÚ¸Ú7¯ÉôÝRÕâ<^0[é J blob_type: 1 flags: 64	success	1

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345037.397269 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00530000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345046.803269 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

39b8625ff243041deb1cdad3f584c0b3.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619345046.397269 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (6 个事件)

host	112.78.142.170
host	172.217.24.14
host	178.128.14.92
host	178.238.232.46
host	185.142.236.163
host	192.210.217.94

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619345049.381269 RegSetValueExA	key_handle: 0x00000398 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619345049.381269 RegSetValueExA	key_handle: 0x00000398 value: àAl:× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619345049.381269 RegSetValueExA	key_handle: 0x00000398 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619345049.397269 RegSetValueExW	key_handle: 0x00000398 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619345049.397269 RegSetValueExA	key_handle: 0x000003b0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619345049.397269 RegSetValueExA	key_handle: 0x000003b0 value: àAl:× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619345049.397269 RegSetValueExA	key_handle: 0x000003b0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619345049.428269 RegSetValueExW	key_handle: 0x00000394 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (7 个事件)

dead_host	185.142.236.163:443
dead_host	178.238.232.46:443
dead_host	192.168.56.101:49179
dead_host	178.128.14.92:8080
dead_host	192.168.56.101:49178
dead_host	192.168.56.101:49177
dead_host	112.78.142.170:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-19 23:55:00

Imports

Library MFC42.DLL:

• 0x40c7ac

• 0x40c7b0

• 0x40c7b4

• 0x40c7b8

• 0x40c7bc

• 0x40c7c0

• 0x40c7c4

• 0x40c7c8

• 0x40c7cc

• 0x40c7d0

• 0x40c7d4

• 0x40c7d8

• 0x40c7dc

• 0x40c7e0

• 0x40c7e4

• 0x40c7e8

• 0x40c7ec

• 0x40c7f0

• 0x40c7f4

• 0x40c7f8

• 0x40c7fc

• 0x40c800

• 0x40c804

• 0x40c808

• 0x40c80c

• 0x40c810

• 0x40c814

• 0x40c818

• 0x40c81c

• 0x40c820

• 0x40c824

• 0x40c828

• 0x40c82c

• 0x40c830

• 0x40c834

• 0x40c838

• 0x40c83c

• 0x40c840

• 0x40c844

• 0x40c848

• 0x40c84c

• 0x40c850

• 0x40c854

• 0x40c858

• 0x40c85c

• 0x40c860

• 0x40c864

• 0x40c868

• 0x40c86c

• 0x40c870

• 0x40c874

• 0x40c878

• 0x40c87c

• 0x40c880

• 0x40c884

• 0x40c888

• 0x40c88c

• 0x40c890

• 0x40c894

• 0x40c898

• 0x40c89c

• 0x40c8a0

• 0x40c8a4

• 0x40c8a8

• 0x40c8ac

• 0x40c8b0

• 0x40c8b4

• 0x40c8b8

• 0x40c8bc

• 0x40c8c0

• 0x40c8c4

• 0x40c8c8

• 0x40c8cc

• 0x40c8d0

• 0x40c8d4

• 0x40c8d8

• 0x40c8dc

• 0x40c8e0

• 0x40c8e4

• 0x40c8e8

• 0x40c8ec

• 0x40c8f0

• 0x40c8f4

• 0x40c8f8

• 0x40c8fc

• 0x40c900

• 0x40c904

• 0x40c908

• 0x40c90c

• 0x40c910

• 0x40c914

• 0x40c918

• 0x40c91c

• 0x40c920

• 0x40c924

• 0x40c928

• 0x40c92c

• 0x40c930

• 0x40c934

• 0x40c938

• 0x40c93c

• 0x40c940

• 0x40c944

• 0x40c948

• 0x40c94c

• 0x40c950

• 0x40c954

• 0x40c958

• 0x40c95c

• 0x40c960

• 0x40c964

• 0x40c968

• 0x40c96c

• 0x40c970

• 0x40c974

• 0x40c978

• 0x40c97c

• 0x40c980

• 0x40c984

• 0x40c988

• 0x40c98c

• 0x40c990

• 0x40c994

• 0x40c998

• 0x40c99c

• 0x40c9a0

• 0x40c9a4

• 0x40c9a8

• 0x40c9ac

• 0x40c9b0

• 0x40c9b4

• 0x40c9b8

• 0x40c9bc

• 0x40c9c0

• 0x40c9c4

• 0x40c9c8

• 0x40c9cc

• 0x40c9d0

• 0x40c9d4

• 0x40c9d8

• 0x40c9dc

• 0x40c9e0

• 0x40c9e4

• 0x40c9e8

• 0x40c9ec

• 0x40c9f0

• 0x40c9f4

• 0x40c9f8

• 0x40c9fc

• 0x40ca00

• 0x40ca04

Library MSVCRT.dll:

• 0x40cae8 _adjust_fdiv

• 0x40caec __p__commode

• 0x40caf0 _initterm

• 0x40caf4 _setmbcp

• 0x40caf8 __p__fmode

• 0x40cafc __set_app_type

• 0x40cb00 _except_handler3

• 0x40cb04 __setusermatherr

• 0x40cb08 __CxxFrameHandler

• 0x40cb0c _mbsnbcpy

• 0x40cb10 _access

• 0x40cb14 _wcslwr

• 0x40cb18 malloc

• 0x40cb1c _mbsstr

• 0x40cb20 __dllonexit

• 0x40cb24 _onexit

• 0x40cb28 _exit

• 0x40cb2c _XcptFilter

• 0x40cb30 exit

• 0x40cb34 _acmdln

• 0x40cb38 __getmainargs

• 0x40cb3c _controlfp

Library KERNEL32.dll:

• 0x40c758 GetStartupInfoA

• 0x40c75c GetModuleHandleA

• 0x40c760 WinExec

• 0x40c764 GetWindowsDirectoryA

• 0x40c768 LoadLibraryA

• 0x40c76c FreeLibrary

• 0x40c770 ExitProcess

• 0x40c774 MulDiv

• 0x40c778 GetCurrentDirectoryA

Library USER32.dll:

• 0x40cbc8 GetMessagePos

• 0x40cbcc SetCursor

• 0x40cbd0 FillRect

• 0x40cbd4 InflateRect

• 0x40cbd8 ReleaseDC

• 0x40cbdc GetDC

• 0x40cbe0 GetParent

• 0x40cbe4 CopyIcon

• 0x40cbe8 LoadCursorA

• 0x40cbec GetSysColor

• 0x40cbf0 PtInRect

• 0x40cbf4 GetSystemMetrics

• 0x40cbf8 DrawIcon

• 0x40cbfc GetSystemMenu

• 0x40cc00 AppendMenuA

• 0x40cc04 LoadIconA

• 0x40cc08 ScreenToClient

• 0x40cc0c FindWindowExA

• 0x40cc10 GetWindowRect

• 0x40cc14 MoveWindow

• 0x40cc18 ShowWindow

• 0x40cc1c GetClientRect

• 0x40cc20 InvalidateRect

• 0x40cc24 SetTimer

• 0x40cc28 MessageBeep

• 0x40cc2c KillTimer

• 0x40cc30 DestroyCursor

• 0x40cc34 RegisterWindowMessageA

• 0x40cc38 IsIconic

• 0x40cc3c RedrawWindow

• 0x40cc40 EnableWindow

• 0x40cc44 SetWindowTextA

• 0x40cc48 SendMessageA

• 0x40cc4c GetDlgItem

• 0x40cc50 GetWindowLongA

• 0x40cc54 SetWindowLongA

• 0x40cc58 IsWindow

Library GDI32.dll:

• 0x40c708 GetTextExtentPoint32A

• 0x40c70c CreateSolidBrush

• 0x40c710 GetStockObject

• 0x40c714 GetObjectA

• 0x40c718 DeleteDC

• 0x40c71c GetDeviceCaps

• 0x40c720 CreateDCA

• 0x40c724 CreateFontIndirectA

Library ADVAPI32.dll:

• 0x40c6d0 RegOpenKeyExA

• 0x40c6d4 RegQueryValueA

• 0x40c6d8 RegCloseKey

Library SHELL32.dll:

• 0x40cb7c SHGetFileInfoA

• 0x40cb80 SHGetSpecialFolderLocation

• 0x40cb84 SHGetSpecialFolderPathA

• 0x40cb88 SHBrowseForFolderA

• 0x40cb8c SHGetPathFromIDListA

• 0x40cb90 SHGetMalloc

• 0x40cb94 ShellExecuteA

Library ole32.dll:

• 0x40cca4 CoInitialize

• 0x40cca8 CoUninitialize

Library MSVCP60.dll:

• 0x40caac ??1Init@ios_base@std@@QAE@XZ

• 0x40cab0 ??0_Winit@std@@QAE@XZ

• 0x40cab4 ??1_Winit@std@@QAE@XZ

• 0x40cab8 ??0Init@ios_base@std@@QAE@XZ

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.