2.8
中危
该样本未表现出任何异常！
重新分析
更多

518394d105b9f9f1c375efe6038468e595bfd4e848940b9af6c6f563f00bbe26

4008e7baf010ba28b944444159e403b8.exe

分析耗时

30s

最近分析

文件大小

183.5KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1619396865.26625
NtProtectVirtualMemory
process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 57344
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x02f4a000
success 0 0
1619396865.26625
NtAllocateVirtualMemory
process_identifier: 2200
region_size: 94208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x00300000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.533619875753151 section {'size_of_data': '0x0001d400', 'virtual_address': '0x00001000', 'entropy': 7.533619875753151, 'name': '.text', 'virtual_size': '0x0001d2da'} description A section with a high entropy has been found
entropy 0.6410958904109589 description Overall entropy of this PE file is high
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2018-10-24 06:19:40

Imports

Library KERNEL32.dll:
• 0x41f00c GetProcessTimes
• 0x41f010 LoadLibraryW
• 0x41f014 LocalHandle
• 0x41f018 ReadFile
• 0x41f01c lstrlenW
• 0x41f020 SetConsoleTitleA
• 0x41f024 GetLastError
• 0x41f028 GetProcAddress
• 0x41f02c BuildCommDCBW
• 0x41f030 GetDriveTypeA
• 0x41f034 WriteConsoleA
• 0x41f03c GlobalUnWire
• 0x41f048 lstrcatW
• 0x41f04c DebugBreakProcess
• 0x41f050 VirtualProtect
• 0x41f054 GetCurrentProcessId
• 0x41f058 OpenFileMappingA
• 0x41f05c EnumSystemLocalesW
• 0x41f060 GetCommandLineA
• 0x41f064 GetUserDefaultLCID
• 0x41f068 HeapAlloc
• 0x41f06c LoadResource
• 0x41f070 MapViewOfFile
• 0x41f074 IsBadStringPtrW
• 0x41f078 FindResourceA
• 0x41f07c CreateTimerQueue
• 0x41f080 GetAtomNameA
• 0x41f084 CreateFileA
• 0x41f088 GetStartupInfoW
• 0x41f08c RaiseException
• 0x41f090 RtlUnwind
• 0x41f094 TerminateProcess
• 0x41f098 GetCurrentProcess
• 0x41f0a4 IsDebuggerPresent
• 0x41f0a8 HeapFree
• 0x41f0ac GetModuleHandleW
• 0x41f0b0 Sleep
• 0x41f0b4 ExitProcess
• 0x41f0b8 WriteFile
• 0x41f0bc GetStdHandle
• 0x41f0c0 GetModuleFileNameA
• 0x41f0c4 GetModuleFileNameW
• 0x41f0d0 GetCommandLineW
• 0x41f0d4 SetHandleCount
• 0x41f0d8 GetFileType
• 0x41f0dc GetStartupInfoA
• 0x41f0e4 TlsGetValue
• 0x41f0e8 TlsAlloc
• 0x41f0ec TlsSetValue
• 0x41f0f0 TlsFree
• 0x41f0f8 SetLastError
• 0x41f0fc GetCurrentThreadId
• 0x41f104 HeapCreate
• 0x41f108 VirtualFree
• 0x41f110 GetTickCount
• 0x41f118 SetFilePointer
• 0x41f11c WideCharToMultiByte
• 0x41f120 GetConsoleCP
• 0x41f124 GetConsoleMode
• 0x41f130 GetCPInfo
• 0x41f134 GetACP
• 0x41f138 GetOEMCP
• 0x41f13c IsValidCodePage
• 0x41f140 VirtualAlloc
• 0x41f144 HeapReAlloc
• 0x41f148 HeapSize
• 0x41f14c LoadLibraryA
• 0x41f154 SetStdHandle
• 0x41f158 GetConsoleOutputCP
• 0x41f15c WriteConsoleW
• 0x41f160 MultiByteToWideChar
• 0x41f164 LCMapStringA
• 0x41f168 LCMapStringW
• 0x41f16c GetStringTypeA
• 0x41f170 GetStringTypeW
• 0x41f174 GetLocaleInfoA
• 0x41f178 GetModuleHandleA
• 0x41f17c CloseHandle
• 0x41f180 FlushFileBuffers
Library ADVAPI32.dll:

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49236 239.255.255.250 3702
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 56542 239.255.255.250 1900
192.168.56.101 57875 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.