SmartHawk

3.6

中危

该样本未表现出任何异常！

重新分析

下载样本

a4ee8a6d041c1b74dc125f07d660f9b0e91d935b1f7b3aea20a7dd92bff19d9e

4190e4a85c61665495001e246f87ac0b.exe

分析耗时

94s

最近分析

文件大小

21.7KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 个事件)

suspicious_features

POST method with no referer header

suspicious_request

POST https://update.googleapis.com/service/update2?cup2key=10:4191074280&cup2hreq=3413a50e72b009a56bdf241eb364ff60411273bb175310ed69824b1fb2bc85f4

Performs some HTTP requests (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:4191074280&cup2hreq=3413a50e72b009a56bdf241eb364ff60411273bb175310ed69824b1fb2bc85f4

Sends data using the HTTP POST Method (1 个事件)

request

POST https://update.googleapis.com/service/update2?cup2key=10:4191074280&cup2hreq=3413a50e72b009a56bdf241eb364ff60411273bb175310ed69824b1fb2bc85f4

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

7.301508643784555

section

{'size_of_data': '0x00000600', 'virtual_address': '0x00006000', 'entropy': 7.301508643784555, 'name': '.data', 'virtual_size': '0x0000062c'}

description

A section with a high entropy has been found

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619384535.281625 InternetOpenA	proxy_bypass: access_type: 1 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	172.217.24.14:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2014-06-26 06:58:59

Imports

Library KERNEL32.dll:

• 0x405040 CreateFileW

• 0x405044 FindFirstFileW

• 0x405048 FindClose

• 0x40504c FindNextFileW

• 0x405050 GetWindowsDirectoryW

• 0x405054 WaitForSingleObject

• 0x405058 GetModuleHandleW

• 0x40505c GetTickCount

• 0x405060 Sleep

• 0x405064 CreateProcessA

• 0x405068 GetModuleFileNameW

• 0x40506c GetStartupInfoA

• 0x405070 ReadFile

• 0x405074 GetFileSize

• 0x405078 DeleteFileA

• 0x40507c CreateThread

• 0x405080 GetProcAddress

• 0x405084 LoadLibraryA

• 0x405088 GetCurrentProcess

• 0x40508c GetLastError

• 0x405090 GetSystemInfo

• 0x405094 GetModuleHandleA

• 0x405098 GlobalAlloc

• 0x40509c GlobalFree

• 0x4050a0 GetTempFileNameA

• 0x4050a4 CreateFileA

• 0x4050a8 CloseHandle

• 0x4050ac GetVersionExA

• 0x4050b0 CreateToolhelp32Snapshot

• 0x4050b4 GetDiskFreeSpaceA

• 0x4050b8 HeapReAlloc

• 0x4050bc Process32Next

• 0x4050c0 GetCurrentDirectoryW

• 0x4050c4 GetSystemDirectoryA

• 0x4050c8 GetFileAttributesW

• 0x4050cc GetVolumeInformationA

• 0x4050d0 OpenProcess

• 0x4050d4 GetDriveTypeA

• 0x4050d8 GetLogicalDrives

• 0x4050dc Process32First

• 0x4050e0 GetDriveTypeW

• 0x4050e4 GetComputerNameA

• 0x4050e8 GetProcessHeap

• 0x4050ec HeapFree

• 0x4050f0 HeapAlloc

• 0x4050f4 GetTempPathA

Library USER32.dll:

• 0x405120 GetWindowRect

• 0x405124 GetWindowDC

• 0x405128 ReleaseDC

• 0x40512c GetDesktopWindow

Library GDI32.dll:

• 0x40501c CreateDIBSection

• 0x405020 CreateCompatibleDC

• 0x405024 DeleteObject

• 0x405028 DeleteDC

• 0x40502c BitBlt

• 0x405030 SelectObject

Library ADVAPI32.dll:

• 0x405000 GetTokenInformation

• 0x405004 OpenProcessToken

• 0x405008 GetUserNameA

• 0x40500c CreateWellKnownSid

• 0x405010 CheckTokenMembership

• 0x405014 DuplicateToken

Library SHELL32.dll:

• 0x405114 SHGetFolderPathW

• 0x405118

Library ole32.dll:

• 0x40518c CreateStreamOnHGlobal

Library ntdll.dll:

• 0x405174 _snwprintf

• 0x405178 _wcsicmp

• 0x40517c sprintf

• 0x405180 memcpy

• 0x405184 memset

Library WININET.dll:

• 0x405134 InternetReadFile

• 0x405138 InternetSetOptionA

• 0x40513c HttpOpenRequestA

• 0x405140 HttpSendRequestA

• 0x405144 InternetOpenA

• 0x405148 InternetCloseHandle

• 0x40514c HttpQueryInfoA

• 0x405150 InternetConnectA

Library IPHLPAPI.DLL:

• 0x405038 GetAdaptersInfo

Library gdiplus.dll:

• 0x405158 GdipSaveImageToStream

• 0x40515c GdipGetImageEncodersSize

• 0x405160 GdipDisposeImage

• 0x405164 GdipCreateBitmapFromHBITMAP

• 0x405168 GdipGetImageEncoders

• 0x40516c GdiplusStartup

Library PSAPI.DLL:

• 0x40510c GetModuleFileNameExA

Library MPR.dll:

• 0x4050fc WNetCloseEnum

• 0x405100 WNetOpenEnumW

• 0x405104 WNetEnumResourceW

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	172.217.24.14
google.com	A 172.217.24.14	93.46.8.90
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
update.googleapis.com	A 203.208.41.98	203.208.41.34
teredo.ipv6.microsoft.com		127.0.0.1

TCP

Source	Source Port	Destination	Destination Port
192.168.56.101	49190	203.208.41.98 update.googleapis.com	443

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	50568	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	54178	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.