SmartHawk

5.0

中危

该样本未表现出任何异常！

重新分析

下载样本

7e2ef8f97469f15dd1592ad0585e37d80fc618a639b0479109d92c7ba7734b49

3bcbec86baab03d00fd6ef0e5ef192c8.exe

分析耗时

86s

最近分析

文件大小

520.5KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619395029.119249 GetComputerNameW	computer_name: OSKAR-PC	success	1	0
1619395030.118999 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

One or more processes crashed (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619395030.790999 __exception__	stacktrace: 3bcbec86baab03d00fd6ef0e5ef192c8+0x3f07 @ 0x403f07 3bcbec86baab03d00fd6ef0e5ef192c8+0x1b25 @ 0x401b25 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637624 registers.edi: 0 registers.eax: 1447909480 registers.ebp: 1637684 registers.edx: 22104 registers.ebx: 1 registers.esi: 9119112 registers.ecx: 10 exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb exception.symbol: 3bcbec86baab03d00fd6ef0e5ef192c8+0x3449 exception.instruction: in eax, dx exception.module: 3bcbec86baab03d00fd6ef0e5ef192c8.exe exception.exception_code: 0xc0000096 exception.offset: 13385 exception.address: 0x403449	success	0	0
1619395030.790999 __exception__	stacktrace: 3bcbec86baab03d00fd6ef0e5ef192c8+0x3f10 @ 0x403f10 3bcbec86baab03d00fd6ef0e5ef192c8+0x1b25 @ 0x401b25 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637628 registers.edi: 0 registers.eax: 1447909480 registers.ebp: 1637684 registers.edx: 22104 registers.ebx: 1 registers.esi: 9119112 registers.ecx: 20 exception.instruction_r: ed 89 45 e4 5a 59 5b 58 83 4d fc ff eb 11 33 c0 exception.symbol: 3bcbec86baab03d00fd6ef0e5ef192c8+0x34e2 exception.instruction: in eax, dx exception.module: 3bcbec86baab03d00fd6ef0e5ef192c8.exe exception.exception_code: 0xc0000096 exception.offset: 13538 exception.address: 0x4034e2	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (6 个事件)

Time & API	Arguments	Status
1619395028.791249 NtAllocateVirtualMemory	process_identifier: 152 region_size: 225280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00490000	success
1619395028.791249 NtAllocateVirtualMemory	process_identifier: 152 region_size: 221184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x004d0000	success
1619395028.791249 NtProtectVirtualMemory	process_identifier: 152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 237568 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success
1619395030.103999 NtAllocateVirtualMemory	process_identifier: 2740 region_size: 225280 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00360000	success
1619395030.103999 NtAllocateVirtualMemory	process_identifier: 2740 region_size: 221184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003a0000	success
1619395030.103999 NtProtectVirtualMemory	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 237568 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x00400000	success

Foreign language identified in PE resource (5 个事件)

name

RT_VERSION

language

LANG_CHINESE

offset

0x00083cb4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000324

name

RT_VERSION

language

LANG_CHINESE

offset

0x00083cb4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000324

name

RT_VERSION

language

LANG_CHINESE

offset

0x00083cb4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000324

name

RT_VERSION

language

LANG_CHINESE

offset

0x00083cb4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000324

name

RT_VERSION

language

LANG_CHINESE

offset

0x00083cb4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000324

A process created a hidden window (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619395029.838249 CreateProcessInternalW	thread_identifier: 580 thread_handle: 0x0000013c process_identifier: 2740 current_directory: filepath: track: 1 command_line: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\3bcbec86baab03d00fd6ef0e5ef192c8.exe /C filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) process_handle: 0x00000140 inherit_handles: 0	success	1	0

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

7.1545440387352714

section

{'size_of_data': '0x0000b000', 'virtual_address': '0x00079000', 'entropy': 7.1545440387352714, 'name': '.rsrc', 'virtual_size': '0x0000afd8'}

description

A section with a high entropy has been found

Expresses interest in specific running processes (1 个事件)

process

vboxservice.exe

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Detects VMWare through the in instruction feature (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619395030.790999 __exception__	stacktrace: 3bcbec86baab03d00fd6ef0e5ef192c8+0x3f07 @ 0x403f07 3bcbec86baab03d00fd6ef0e5ef192c8+0x1b25 @ 0x401b25 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5 registers.esp: 1637624 registers.edi: 0 registers.eax: 1447909480 registers.ebp: 1637684 registers.edx: 22104 registers.ebx: 1 registers.esi: 9119112 registers.ecx: 10 exception.instruction_r: ed 89 5d e4 89 4d e0 5a 59 5b 58 83 4d fc ff eb exception.symbol: 3bcbec86baab03d00fd6ef0e5ef192c8+0x3449 exception.instruction: in eax, dx exception.module: 3bcbec86baab03d00fd6ef0e5ef192c8.exe exception.exception_code: 0xc0000096 exception.offset: 13385 exception.address: 0x403449	success	0	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-05-14 08:46:12

Imports

Library KERNEL32.dll:

• 0x477f74 HeapFree

• 0x477f78 GetProcessHeap

• 0x477f7c GetModuleHandleW

• 0x477f80 GetModuleHandleA

• 0x477f84 LoadLibraryW

• 0x477f88 GetProcAddress

• 0x477f8c FreeLibrary

• 0x477f90 OutputDebugStringW

• 0x477f94 GetLocalTime

• 0x477f98 WriteFile

• 0x477f9c SetFilePointer

• 0x477fa0 ExpandEnvironmentStringsW

• 0x477fa4 GetEnvironmentVariableW

• 0x477fa8 HeapAlloc

• 0x477fac CreateFileW

• 0x477fb0 DeviceIoControl

• 0x477fb4 CreateThread

• 0x477fb8 WaitForSingleObject

• 0x477fbc GetCurrentProcess

• 0x477fc0 GetLastError

• 0x477fc4 CloseHandle

• 0x477fc8 ExitThread

• 0x477fcc SetLastError

• 0x477fd0 VirtualAlloc

Library USER32.dll:

• 0x477fd8 GetCaretBlinkTime

• 0x477fdc EndMenu

• 0x477fe0 CloseDesktop

• 0x477fe4 IsCharAlphaNumericW

• 0x477fe8 DestroyWindow

• 0x477fec IsCharAlphaW

• 0x477ff0 IsCharLowerW

• 0x477ff4 PaintDesktop

• 0x477ff8 CharLowerW

• 0x477ffc CountClipboardFormats

• 0x478000 CopyIcon

• 0x478004 GetClipboardViewer

• 0x478008 GetSysColor

• 0x47800c GetSysColorBrush

• 0x478010 GetClipboardData

• 0x478014 LoadIconA

• 0x478018 GetDoubleClickTime

Library GDI32.dll:

• 0x478020 GetEnhMetaFileW

• 0x478024 DeleteEnhMetaFile

• 0x478028 DeleteObject

• 0x47802c GetROP2

• 0x478030 RealizePalette

• 0x478034 PathToRegion

• 0x478038 AddFontResourceW

• 0x47803c GetBkMode

• 0x478040 AddFontResourceA

• 0x478044 GetPixelFormat

• 0x478048 BeginPath

• 0x47804c GetStockObject

Library ADVAPI32.dll:

• 0x478054 RegOpenKeyA

• 0x478058 RegQueryValueExA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.24.14
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.