3.0
中危
该样本未表现出任何异常！
重新分析
更多

13ae4b707ca65efe9a675c0a5c1cda53353f07eba44f6a6a158339c79eca95eb

406f7d4b498704ca18f847c39cd232c6.exe

分析耗时

93s

最近分析

文件大小

448.6KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1619422446.769626
GetComputerNameW
computer_name:
failed 0 0
1619422446.769626
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
This executable is signed
行为判定
动态指标
HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)
suspicious_features POST method with no referer header suspicious_request POST https://update.googleapis.com/service/update2?cup2key=10:1488598116&cup2hreq=ad493f6ec57542dc14c8319b5d59f0d3e36ddec47351b585a967c5e258e68f85
Performs some HTTP requests (4 个事件)
request HEAD http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe
request HEAD http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619393295&mv=m&mvi=1&pl=23&shardbypass=yes
request HEAD http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=c7a9ef644369a8da&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619393295&mv=m
request POST https://update.googleapis.com/service/update2?cup2key=10:1488598116&cup2hreq=ad493f6ec57542dc14c8319b5d59f0d3e36ddec47351b585a967c5e258e68f85
Sends data using the HTTP POST Method (1 个事件)
request POST https://update.googleapis.com/service/update2?cup2key=10:1488598116&cup2hreq=ad493f6ec57542dc14c8319b5d59f0d3e36ddec47351b585a967c5e258e68f85
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1619422442.238626
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x00780000
success 0 0
1619422445.582626
NtAllocateVirtualMemory
process_identifier: 1760
region_size: 159744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x007b0000
success 0 0
1619422445.582626
NtProtectVirtualMemory
process_identifier: 1760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 65536
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-06-03 02:50:16

Imports

Library KERNEL32.dll:
• 0x46edd0 GetModuleHandleA
• 0x46edd4 LoadLibraryA
• 0x46edd8 GetProcAddress
• 0x46eddc VirtualAlloc
• 0x46ede0 GetLastError
• 0x46ede4 GetThreadLocale
• 0x46ede8 VirtualAllocEx
• 0x46edec ReplaceFileW
• 0x46edf0 GetCommMask
• 0x46edf8 GetConsoleCP
• 0x46edfc SetComputerNameExW
• 0x46ee00 GetComputerNameA
• 0x46ee08 GlobalCompact
• 0x46ee0c SetCommConfig
• 0x46ee18 SetStdHandle
• 0x46ee1c lstrcmpiA
• 0x46ee20 GetCPInfo
• 0x46ee34 SetPriorityClass
• 0x46ee38 GetCurrentProcess
• 0x46ee3c GetVersionExW
• 0x46ee40 VirtualProtect
• 0x46ee44 GetSystemInfo
• 0x46ee48 VirtualQuery
• 0x46ee4c MultiByteToWideChar
• 0x46ee50 lstrlenW
• 0x46ee54 lstrcpyW
• 0x46ee68 lstrcmpiW
• 0x46ee6c HeapDestroy
• 0x46ee70 SetEvent
• 0x46ee74 CloseHandle
• 0x46ee78 WaitForSingleObject
• 0x46ee7c lstrcpynW
• 0x46ee80 GetModuleFileNameW
• 0x46ee84 FreeLibrary
• 0x46ee88 LoadLibraryW
• 0x46ee8c CreateThread
• 0x46ee90 CreateEventW
• 0x46ee94 lstrcatW
• 0x46ee98 lstrlenA
• 0x46ee9c SizeofResource
• 0x46eea0 LoadResource
• 0x46eea4 FindResourceW
• 0x46eea8 LoadLibraryExW
• 0x46eeac Sleep
• 0x46eeb0 HeapSetInformation
• 0x46eeb4 GetCurrentThreadId
• 0x46eeb8 GetCommandLineW
• 0x46eec0 TerminateProcess
• 0x46eec8 GetCurrentProcessId
• 0x46eecc GetTickCount
• 0x46eed4 RtlUnwind
• 0x46eed8 GetStartupInfoW
• 0x46eee0 InterlockedExchange
Library USER32.dll:
• 0x46eeec LoadIconA
• 0x46eef0 IsGUIThread
• 0x46eef4 IsCharAlphaA
• 0x46eef8 IsCharLowerA
• 0x46eefc IsCharAlphaNumericW
• 0x46ef00 IsCharAlphaNumericA
• 0x46ef04 IsCharLowerW
• 0x46ef08 IsCharAlphaW
• 0x46ef0c IsCharUpperA
• 0x46ef14 IsCharUpperW
• 0x46ef18 IsWindowUnicode
• 0x46ef1c GetMenu
• 0x46ef20 DrawIcon
• 0x46ef24 IsChild
• 0x46ef28 GetNextDlgGroupItem
• 0x46ef2c CheckMenuItem
• 0x46ef30 DrawFrame
• 0x46ef38 GetMenuInfo
• 0x46ef3c GetInputDesktop
• 0x46ef40 GetThreadDesktop
• 0x46ef44 DdeNameService
• 0x46ef4c SetClassLongA
• 0x46ef50 GetWindowRgn
• 0x46ef54 GetParent
• 0x46ef58 ReleaseCapture
• 0x46ef5c LoadCursorFromFileA
• 0x46ef60 DefDlgProcW
• 0x46ef64 GetKeyNameTextA
• 0x46ef68 DdeUnaccessData
• 0x46ef6c GetScrollInfo
• 0x46ef70 GetQueueStatus
• 0x46ef78 EditWndProc
• 0x46ef7c SetWindowPos
• 0x46ef80 IMPSetIMEA
• 0x46ef84 DdeReconnect
• 0x46ef88 IMPQueryIMEW
• 0x46ef8c SetWindowRgn
• 0x46ef90 DdeAddData
• 0x46ef94 DispatchMessageW
• 0x46ef98 CharPrevW
• 0x46ef9c PostThreadMessageW
• 0x46efa0 CharNextW
• 0x46efa4 GetMessageW
Library GDI32.dll:
• 0x46efac GetEnhMetaFileA
• 0x46efb0 RectInRegion
• 0x46efb4 CLIPOBJ_cEnumStart
• 0x46efb8 GetTextMetricsW
• 0x46efc0 GetWindowExtEx
• 0x46efc4 RoundRect
• 0x46efc8 CreateDIBitmap
• 0x46efd0 EngDeleteClip
• 0x46efd4 GetICMProfileW
• 0x46efdc FONTOBJ_pfdg
• 0x46efe0 Rectangle
• 0x46efe4 PolyBezier
• 0x46efec GetMetaRgn
• 0x46eff0 GdiGetCodePage
• 0x46eff4 SetAbortProc
• 0x46eff8 GdiReleaseLocalDC
Library ADVAPI32.dll:
• 0x46f000 RegQueryValueExW
• 0x46f004 GetUserNameW
• 0x46f008 RegDeleteKeyW
• 0x46f00c RegDeleteValueW
• 0x46f010 RegCloseKey
• 0x46f014 RegCreateKeyExW
• 0x46f018 RegOpenKeyExW
• 0x46f01c RegSetValueExW
• 0x46f020 RegQueryInfoKeyW
• 0x46f024 RegEnumValueW
• 0x46f028 RegEnumKeyExW
Library SHELL32.dll:
• 0x46f030 ShellExecuteExA
• 0x46f034 DragFinish
• 0x46f038 ExtractIconW
• 0x46f03c FindExecutableA
• 0x46f040 SHGetFolderPathW
• 0x46f044 DoEnvironmentSubstW
• 0x46f048 SHLoadInProc
• 0x46f04c SHFormatDrive
Library ole32.dll:
• 0x46f058 CoInitialize
• 0x46f05c CoUninitialize
• 0x46f060 CoTaskMemRealloc
• 0x46f064 CoTaskMemAlloc
• 0x46f068 CoTaskMemFree
• 0x46f070 CoRevokeClassObject
• 0x46f074 CoCreateInstance

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
192.168.56.101 49186 113.108.239.194 r1---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49187 113.108.239.196 r3---sn-j5o7dn7e.gvt1.com 80
192.168.56.101 49185 203.208.41.97 redirector.gvt1.com 80
192.168.56.101 49184 203.208.41.98 update.googleapis.com 443

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 54178 114.114.114.114 53
192.168.56.101 54260 114.114.114.114 53
192.168.56.101 54991 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 58070 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355

HTTP & HTTPS Requests

URI Data
http://redirector.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: redirector.gvt1.com
http://r3---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=c7a9ef644369a8da&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619393295&mv=m 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?mh=ms&mvi=3&pl=17&shardbypass=yes&redirect_counter=1&rm=sn-j5ok7e&req_id=c7a9ef644369a8da&cms_redirect=yes&ipbypass=yes&mip=59.50.85.19&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619393295&mv=m HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r3---sn-j5o7dn7e.gvt1.com
http://r1---sn-j5o7dn7e.gvt1.com/edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619393295&mv=m&mvi=1&pl=23&shardbypass=yes 
HEAD /edgedl/release2/update2/AIUdiWYcaIvMz1IBNCM0PPo_1.3.36.82/GoogleUpdateSetup.exe?cms_redirect=yes&mh=ms&mip=202.100.214.100&mm=28&mn=sn-j5o7dn7e&ms=nvh&mt=1619393295&mv=m&mvi=1&pl=23&shardbypass=yes HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
X-Old-UID: cnt=0
X-Last-HR: 0x0
X-Last-HTTP-Status-Code: 0
X-Retry-Count: 0
X-HTTP-Attempts: 1
Host: r1---sn-j5o7dn7e.gvt1.com

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.