SmartHawk

4.8

中危

该样本未表现出任何异常！

重新分析

下载样本

8f2b4f1905c4fa16eab6c1a8ca5205d024d05869d41614bb287108f758eaee08

3e1b967d4083441f581ba9151664634c.exe

分析耗时

86s

最近分析

文件大小

420.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619384547.188 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (4 个事件)

Time & API	Arguments	Status	Return
1619384537.953 CryptGenKey	crypto_handle: 0x005b4e70 algorithm_identifier: 0x0000660e () provider_handle: 0x005b4488 flags: 1 key: fý2Ú¸µî£û3èsÖé	success	1
1619384547.203 CryptExportKey	crypto_handle: 0x005b4e70 crypto_export_handle: 0x005b4550 buffer: f¤éÇÆæ#ì¥ûuø{ðÖ½Û!·-ßç¤B_>;VrÁe¢ÝÍ®®,S+´ÍnÄÀw¾D'¤a{!BE} §{· c Q\¥ªñMð@6Ê=Á¹ blob_type: 1 flags: 64	success	1
1619384574.703 CryptExportKey	crypto_handle: 0x005b4e70 crypto_export_handle: 0x005b4550 buffer: f¤Ï(N@ïH¶°BrtÊQÈ)Î¶º¯Ú.eÌ¢p]H<^?Ñ:!ýúØÆ-¤ÄèÖ$W?P,Iÿ>xd\| »ef=×$üêÕÛ¤ý¸ë4cÊÝ¨} blob_type: 1 flags: 64	success	1
1619384577.75 CryptExportKey	crypto_handle: 0x005b4e70 crypto_export_handle: 0x005b4550 buffer: f¤Â89d{LáAªl- gçZQ-mÑUZ[+8^feüÜs-" c07w$z¼ÆG<>Hà%^O]Nõ+°Ù½°»Û4n)ªvÝMÎ )7 blob_type: 1 flags: 64	success	1

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619384537.25 NtAllocateVirtualMemory	process_identifier: 2436 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01ee0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619384547.75 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

3e1b967d4083441f581ba9151664634c.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619384547.406 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (4 个事件)

host	172.217.24.14
host	173.81.218.65
host	45.55.36.51
host	91.83.93.99

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619384550.328 RegSetValueExA	key_handle: 0x000003c8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619384550.328 RegSetValueExA	key_handle: 0x000003c8 value: ðáÄ6V:× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619384550.328 RegSetValueExA	key_handle: 0x000003c8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619384550.328 RegSetValueExW	key_handle: 0x000003c8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619384550.328 RegSetValueExA	key_handle: 0x000003e0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619384550.328 RegSetValueExA	key_handle: 0x000003e0 value: ðáÄ6V:× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619384550.328 RegSetValueExA	key_handle: 0x000003e0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619384550.344 RegSetValueExW	key_handle: 0x000003c4 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)

dead_host	172.217.24.14:443
dead_host	91.83.93.99:7080
dead_host	172.217.160.78:443
dead_host	173.81.218.65:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-26 16:57:04

Imports

Library KERNEL32.dll:

• 0x4300f0 SetErrorMode

• 0x4300f4 RtlUnwind

• 0x4300f8 HeapAlloc

• 0x4300fc HeapFree

• 0x430100 HeapReAlloc

• 0x430104 VirtualAlloc

• 0x430108 GetCommandLineA

• 0x43010c GetProcessHeap

• 0x430110 GetStartupInfoA

• 0x430114 RaiseException

• 0x430118 ExitThread

• 0x43011c CreateThread

• 0x430120 HeapSize

• 0x430124 TerminateProcess

• 0x430128 UnhandledExceptionFilter

• 0x43012c SetUnhandledExceptionFilter

• 0x430130 IsDebuggerPresent

• 0x430134 GetACP

• 0x430138 VirtualFree

• 0x43013c HeapDestroy

• 0x430140 HeapCreate

• 0x430144 GetStdHandle

• 0x430148 LCMapStringA

• 0x43014c LCMapStringW

• 0x430150 FreeEnvironmentStringsA

• 0x430154 GetEnvironmentStrings

• 0x430158 FreeEnvironmentStringsW

• 0x43015c GetEnvironmentStringsW

• 0x430160 SetHandleCount

• 0x430164 GetFileType

• 0x430168 QueryPerformanceCounter

• 0x43016c GetTickCount

• 0x430170 GetSystemTimeAsFileTime

• 0x430174 GetConsoleCP

• 0x430178 GetConsoleMode

• 0x43017c GetStringTypeA

• 0x430180 GetStringTypeW

• 0x430184 SetStdHandle

• 0x430188 WriteConsoleA

• 0x43018c GetConsoleOutputCP

• 0x430190 WriteConsoleW

• 0x430194 FlushFileBuffers

• 0x430198 SetFilePointer

• 0x43019c WriteFile

• 0x4301a0 ReadFile

• 0x4301a4 WritePrivateProfileStringA

• 0x4301a8 GetThreadLocale

• 0x4301ac GetOEMCP

• 0x4301b0 GetCPInfo

• 0x4301b4 GlobalFlags

• 0x4301b8 TlsFree

• 0x4301bc DeleteCriticalSection

• 0x4301c0 LocalReAlloc

• 0x4301c4 TlsSetValue

• 0x4301c8 TlsAlloc

• 0x4301cc InitializeCriticalSection

• 0x4301d0 GlobalHandle

• 0x4301d4 GlobalReAlloc

• 0x4301d8 EnterCriticalSection

• 0x4301dc TlsGetValue

• 0x4301e0 LeaveCriticalSection

• 0x4301e4 LocalAlloc

• 0x4301e8 InterlockedIncrement

• 0x4301ec GetCurrentProcessId

• 0x4301f0 SuspendThread

• 0x4301f4 ResumeThread

• 0x4301f8 SetThreadPriority

• 0x4301fc GetCurrentThread

• 0x430200 ConvertDefaultLocale

• 0x430204 GetModuleFileNameA

• 0x430208 EnumResourceLanguagesA

• 0x43020c GetLocaleInfoA

• 0x430210 lstrcmpA

• 0x430214 InterlockedDecrement

• 0x430218 GetModuleFileNameW

• 0x43021c FreeResource

• 0x430220 GlobalGetAtomNameA

• 0x430224 GlobalAddAtomA

• 0x430228 GlobalFindAtomA

• 0x43022c GlobalDeleteAtom

• 0x430230 lstrcmpW

• 0x430234 GetVersionExA

• 0x430238 GetModuleHandleA

• 0x43023c GetProcAddress

• 0x430240 GlobalFree

• 0x430244 FormatMessageA

• 0x430248 LocalFree

• 0x43024c MulDiv

• 0x430250 ExitProcess

• 0x430254 IsBadWritePtr

• 0x430258 CreateEventA

• 0x43025c SetEvent

• 0x430260 ReleaseMutex

• 0x430264 WaitForSingleObject

• 0x430268 CreateFileA

• 0x43026c CreateFileMappingA

• 0x430270 MapViewOfFile

• 0x430274 UnmapViewOfFile

• 0x430278 CloseHandle

• 0x43027c FlushViewOfFile

• 0x430280 GetWindowsDirectoryA

• 0x430284 LoadLibraryA

• 0x430288 FreeLibrary

• 0x43028c WinExec

• 0x430290 lstrlenA

• 0x430294 CompareStringA

• 0x430298 GetVersion

• 0x43029c MultiByteToWideChar

• 0x4302a0 InterlockedExchange

• 0x4302a4 CreateMutexA

• 0x4302a8 SetLastError

• 0x4302ac GetCurrentThreadId

• 0x4302b0 GetCurrentProcess

• 0x4302b4 GetLastError

• 0x4302b8 GetEnvironmentVariableA

• 0x4302bc Sleep

• 0x4302c0 GlobalAlloc

• 0x4302c4 GlobalLock

• 0x4302c8 GlobalUnlock

• 0x4302cc WideCharToMultiByte

• 0x4302d0 FindResourceA

• 0x4302d4 LoadResource

• 0x4302d8 LockResource

• 0x4302dc SizeofResource

Library USER32.dll:

• 0x430308 GetWindowThreadProcessId

• 0x43030c GetSysColorBrush

• 0x430310 UnregisterClassA

• 0x430314 GetNextDlgTabItem

• 0x430318 EndDialog

• 0x43031c IsWindowEnabled

• 0x430320 MoveWindow

• 0x430324 SetWindowTextA

• 0x430328 IsDialogMessageA

• 0x43032c SetMenuItemBitmaps

• 0x430330 GetMenuCheckMarkDimensions

• 0x430334 LoadBitmapA

• 0x430338 ModifyMenuA

• 0x43033c EnableMenuItem

• 0x430340 CheckMenuItem

• 0x430344 SendDlgItemMessageA

• 0x430348 WinHelpA

• 0x43034c GetCapture

• 0x430350 SetWindowsHookExA

• 0x430354 CallNextHookEx

• 0x430358 GetClassLongA

• 0x43035c GetClassNameA

• 0x430360 SetPropA

• 0x430364 GetPropA

• 0x430368 RemovePropA

• 0x43036c GetFocus

• 0x430370 SetFocus

• 0x430374 GetWindowTextLengthA

• 0x430378 GetWindowTextA

• 0x43037c GetForegroundWindow

• 0x430380 GetLastActivePopup

• 0x430384 SetActiveWindow

• 0x430388 DispatchMessageA

• 0x43038c GetDlgItem

• 0x430390 GetTopWindow

• 0x430394 UnhookWindowsHookEx

• 0x430398 GetMessageTime

• 0x43039c PeekMessageA

• 0x4303a0 MapWindowPoints

• 0x4303a4 GetKeyState

• 0x4303a8 SetForegroundWindow

• 0x4303ac IsWindowVisible

• 0x4303b0 UpdateWindow

• 0x4303b4 GetMenu

• 0x4303b8 PostMessageA

• 0x4303bc MessageBoxA

• 0x4303c0 GetClassInfoExA

• 0x4303c4 GetClassInfoA

• 0x4303c8 RegisterClassA

• 0x4303cc AdjustWindowRectEx

• 0x4303d0 CopyRect

• 0x4303d4 GetDlgCtrlID

• 0x4303d8 DefWindowProcA

• 0x4303dc CallWindowProcA

• 0x4303e0 GetWindowLongA

• 0x4303e4 SetWindowPos

• 0x4303e8 SystemParametersInfoA

• 0x4303ec GetWindowPlacement

• 0x4303f0 GetWindow

• 0x4303f4 EndPaint

• 0x4303f8 BeginPaint

• 0x4303fc ClientToScreen

• 0x430400 GetMenuState

• 0x430404 GetMenuItemID

• 0x430408 GetMenuItemCount

• 0x43040c GetClientRect

• 0x430410 InvalidateRect

• 0x430414 EnableWindow

• 0x430418 TabbedTextOutA

• 0x43041c DrawTextA

• 0x430420 DrawTextExA

• 0x430424 LoadIconA

• 0x430428 IsIconic

• 0x43042c GetSystemMenu

• 0x430430 AppendMenuA

• 0x430434 DrawIcon

• 0x430438 ShowWindow

• 0x43043c CreateWindowExA

• 0x430440 InSendMessage

• 0x430444 GetSystemMetrics

• 0x430448 LoadMenuA

• 0x43044c GetSubMenu

• 0x430450 DrawFocusRect

• 0x430454 RegisterWindowMessageA

• 0x430458 SetWindowLongA

• 0x43045c CopyIcon

• 0x430460 GetMessageA

• 0x430464 TranslateMessage

• 0x430468 ValidateRect

• 0x43046c PostQuitMessage

• 0x430470 DestroyMenu

• 0x430474 GetCursorPos

• 0x430478 WindowFromPoint

• 0x43047c GetDesktopWindow

• 0x430480 GetActiveWindow

• 0x430484 DestroyWindow

• 0x430488 CreateDialogIndirectParamA

• 0x43048c GrayStringA

• 0x430490 GetSysColor

• 0x430494 CloseClipboard

• 0x430498 OpenClipboard

• 0x43049c SetClipboardData

• 0x4304a0 EmptyClipboard

• 0x4304a4 SendMessageA

• 0x4304a8 IsWindow

• 0x4304ac wsprintfA

• 0x4304b0 GetUserObjectInformationA

• 0x4304b4 GetThreadDesktop

• 0x4304b8 SetCursor

• 0x4304bc PtInRect

• 0x4304c0 DestroyCursor

• 0x4304c4 MessageBeep

• 0x4304c8 GetMessagePos

• 0x4304cc LoadCursorA

• 0x4304d0 GetParent

• 0x4304d4 KillTimer

• 0x4304d8 SetTimer

• 0x4304dc RedrawWindow

• 0x4304e0 ReleaseDC

• 0x4304e4 GetDC

• 0x4304e8 ScreenToClient

• 0x4304ec GetWindowRect

• 0x4304f0 InflateRect

• 0x4304f4 TrackPopupMenu

Library GDI32.dll:

• 0x430034 SelectObject

• 0x430038 SetViewportOrgEx

• 0x43003c OffsetViewportOrgEx

• 0x430040 SetViewportExtEx

• 0x430044 ScaleViewportExtEx

• 0x430048 SetWindowOrgEx

• 0x43004c SetWindowExtEx

• 0x430050 ScaleWindowExtEx

• 0x430054 DeleteDC

• 0x430058 CreateBitmap

• 0x43005c SelectClipRgn

• 0x430060 DeleteObject

• 0x430064 GetClipBox

• 0x430068 SetTextAlign

• 0x43006c MoveToEx

• 0x430070 LineTo

• 0x430074 CreatePen

• 0x430078 SetMapMode

• 0x43007c SetTextColor

• 0x430080 SetBkMode

• 0x430084 SetBkColor

• 0x430088 RestoreDC

• 0x43008c SaveDC

• 0x430090 GetDeviceCaps

• 0x430094 GetCharWidthA

• 0x430098 GetTextExtentPoint32A

• 0x43009c GetStockObject

• 0x4300a0 GetObjectA

• 0x4300a4 CreateFontIndirectA

• 0x4300a8 Escape

• 0x4300ac ExtTextOutA

• 0x4300b0 TextOutA

• 0x4300b4 RectVisible

• 0x4300b8 PtVisible

• 0x4300bc GetTextMetricsA

• 0x4300c0 BitBlt

• 0x4300c4 Polygon

• 0x4300c8 LPtoDP

• 0x4300cc DPtoLP

• 0x4300d0 GetMapMode

• 0x4300d4 GetBkColor

• 0x4300d8 CreateCompatibleDC

• 0x4300dc CreatePolygonRgn

• 0x4300e0 CreateCompatibleBitmap

• 0x4300e4 CreateFontA

• 0x4300e8 CreateSolidBrush

Library WINSPOOL.DRV:

• 0x4304fc ClosePrinter

• 0x430500 DocumentPropertiesA

• 0x430504 OpenPrinterA

Library ADVAPI32.dll:

• 0x430000 RegSetValueExA

• 0x430004 RegCreateKeyExA

• 0x430008 RegEnumKeyA

• 0x43000c RegDeleteKeyA

• 0x430010 RegQueryValueExA

• 0x430014 RegOpenKeyA

• 0x430018 RegOpenKeyExA

• 0x43001c RegQueryValueA

• 0x430020 RegCloseKey

• 0x430024 OpenProcessToken

• 0x430028 GetTokenInformation

• 0x43002c GetUserNameA

Library SHELL32.dll:

• 0x4302f4 ShellExecuteA

Library SHLWAPI.dll:

• 0x4302fc PathFindFileNameA

• 0x430300 PathFindExtensionA

Library OLEAUT32.dll:

• 0x4302e4 VariantClear

• 0x4302e8 VariantChangeType

• 0x4302ec VariantInit

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	172.217.24.14
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49176	45.55.36.51	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355

HTTP & HTTPS Requests

URI	Data
http://45.55.36.51:443/yl4exv/	POST /yl4exv/ HTTP/1.1 Content-Type: multipart/form-data; boundary=-------------------------4e7de1e154ef89834605f7bb4868d62b User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 45.55.36.51:443 Content-Length: 4516 Connection: Keep-Alive Cache-Control: no-cache

URI

Data

http://45.55.36.51:443/yl4exv/

POST /yl4exv/ HTTP/1.1
Content-Type: multipart/form-data; boundary=-------------------------4e7de1e154ef89834605f7bb4868d62b
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
Host: 45.55.36.51:443
Content-Length: 4516
Connection: Keep-Alive
Cache-Control: no-cache

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.