SmartHawk

2.2

中危

该样本未表现出任何异常！

重新分析

下载样本

7a755f37dfb67f9ee5f00330aeb01fc6262adc740d610549dbb2ec83e99a2618

3c47958dceec6beac4ef5c8fddacfa22.exe

分析耗时

47s

最近分析

文件大小

326.5KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619411311.672875 IsDebuggerPresent		failed	0	0

This executable has a PDB path (1 个事件)

pdb_path

C:\Codes\Version11\stub_11\Release\stub_11.pdb

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619411316.078875 NtProtectVirtualMemory	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 176128 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x0092b000	success	0	0
1619411317.109875 NtAllocateVirtualMemory	process_identifier: 2424 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02fd0000	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.915198185219742

section

{'size_of_data': '0x00041600', 'virtual_address': '0x0000b000', 'entropy': 7.915198185219742, 'name': '.data', 'virtual_size': '0x000435fc'}

description

A section with a high entropy has been found

entropy

0.8033794162826421

description

Overall entropy of this PE file is high

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-05-19 06:24:17

Imports

Library KERNEL32.dll:

• 0x408000 VirtualProtect

• 0x408004 CloseHandle

• 0x408008 WriteConsoleW

• 0x40800c SetFilePointerEx

• 0x408010 SetStdHandle

• 0x408014 GetConsoleMode

• 0x408018 GetConsoleCP

• 0x40801c FlushFileBuffers

• 0x408020 LCMapStringEx

• 0x408024 HeapSize

• 0x408028 GetStringTypeW

• 0x40802c WideCharToMultiByte

• 0x408030 HeapReAlloc

• 0x408034 RtlUnwind

• 0x408038 GetCommandLineW

• 0x40803c IsDebuggerPresent

• 0x408040 IsProcessorFeaturePresent

• 0x408044 HeapAlloc

• 0x408048 EncodePointer

• 0x40804c DecodePointer

• 0x408050 RaiseException

• 0x408054 GetLastError

• 0x408058 HeapFree

• 0x40805c SetLastError

• 0x408060 InterlockedIncrement

• 0x408064 InterlockedDecrement

• 0x408068 GetCurrentThreadId

• 0x40806c ExitProcess

• 0x408070 GetModuleHandleExW

• 0x408074 GetProcAddress

• 0x408078 MultiByteToWideChar

• 0x40807c GetStdHandle

• 0x408080 WriteFile

• 0x408084 GetModuleFileNameW

• 0x408088 GetProcessHeap

• 0x40808c GetFileType

• 0x408090 InitializeCriticalSectionAndSpinCount

• 0x408094 DeleteCriticalSection

• 0x408098 InitOnceExecuteOnce

• 0x40809c GetStartupInfoW

• 0x4080a0 QueryPerformanceCounter

• 0x4080a4 GetSystemTimeAsFileTime

• 0x4080a8 GetTickCount64

• 0x4080ac GetEnvironmentStringsW

• 0x4080b0 FreeEnvironmentStringsW

• 0x4080b4 UnhandledExceptionFilter

• 0x4080b8 SetUnhandledExceptionFilter

• 0x4080bc FlsAlloc

• 0x4080c0 FlsGetValue

• 0x4080c4 FlsSetValue

• 0x4080c8 FlsFree

• 0x4080cc GetCurrentProcess

• 0x4080d0 TerminateProcess

• 0x4080d4 GetModuleHandleW

• 0x4080d8 EnterCriticalSection

• 0x4080dc LeaveCriticalSection

• 0x4080e0 Sleep

• 0x4080e4 IsValidCodePage

• 0x4080e8 GetACP

• 0x4080ec GetOEMCP

• 0x4080f0 GetCPInfo

• 0x4080f4 LoadLibraryExW

• 0x4080f8 OutputDebugStringW

• 0x4080fc LoadLibraryW

• 0x408100 CreateFileW

Library USER32.dll:

• 0x408108 EndDialog

• 0x40810c PostQuitMessage

• 0x408110 EndPaint

• 0x408114 BeginPaint

• 0x408118 DefWindowProcW

• 0x40811c DestroyWindow

• 0x408120 DialogBoxParamW

• 0x408124 UpdateWindow

• 0x408128 ShowWindow

• 0x40812c CreateWindowExW

• 0x408130 RegisterClassExW

• 0x408134 LoadCursorW

• 0x408138 LoadIconW

• 0x40813c DispatchMessageW

• 0x408140 TranslateMessage

• 0x408144 TranslateAcceleratorW

• 0x408148 GetMessageW

• 0x40814c LoadAcceleratorsW

• 0x408150 LoadStringW

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	172.217.24.14
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	53658	239.255.255.250	3702
192.168.56.101	55369	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.