SmartHawk

1.0

低危

该样本未表现出任何异常！

重新分析

下载样本

a0bbac756da8bed079ad8c2cc6e4ed90279db363f0b1c0e4b83af06800b2fb89

41dba1ace352347741cffccb13c61357.exe

分析耗时

83s

查杀引擎	查杀时间	查杀版本
McAfee	20201001	6.0.6.653
Alibaba	20190527	0.3.0.5
Avast	20201001	18.4.3895.0
Baidu	20190318	1.0.0.2
Kingsoft	20201001	2013.8.14.323
Tencent	20201001	1.0.0.1
CrowdStrike	20190702	1.0

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2017-07-13 14:45:10

Imports

Library WININET.dll:

• 0x4475e4 InternetReadFile

• 0x4475e8 HttpAddRequestHeadersA

• 0x4475ec InternetOpenA

• 0x4475f0 InternetConnectA

• 0x4475f4 InternetCloseHandle

• 0x4475f8 HttpOpenRequestA

• 0x4475fc InternetSetOptionA

• 0x447600 HttpSendRequestA

• 0x447604 InternetSetFilePointer

• 0x447608 InternetSetOptionExA

• 0x44760c FtpSetCurrentDirectoryA

• 0x447610 FtpPutFileA

• 0x447614 FtpGetFileA

• 0x447618 InternetGetLastResponseInfoA

• 0x44761c InternetSetStatusCallback

Library SHLWAPI.dll:

• 0x4473a0 PathFindExtensionA

• 0x4473a4 PathIsDirectoryA

• 0x4473a8 SHGetValueA

• 0x4473ac PathFindFileNameA

• 0x4473b0 PathFileExistsA

• 0x4473b4 PathStripToRootA

• 0x4473b8 PathIsUNCA

• 0x4473bc StrStrIA

Library VERSION.dll:

• 0x4475d4 GetFileVersionInfoA

• 0x4475d8 GetFileVersionInfoSizeA

• 0x4475dc VerQueryValueA

Library ole32.dll:

• 0x447634 OleFlushClipboard

• 0x447638 CoInitializeEx

• 0x44763c CoUninitialize

• 0x447640 CoCreateInstance

• 0x447644 CreateStreamOnHGlobal

• 0x447648 CoTaskMemFree

• 0x44764c CoRegisterMessageFilter

• 0x447650 CoTaskMemAlloc

• 0x447654 CLSIDFromProgID

• 0x447658 CLSIDFromString

• 0x44765c CoGetClassObject

• 0x447660 StgOpenStorageOnILockBytes

• 0x447664 StgCreateDocfileOnILockBytes

• 0x447668 CreateILockBytesOnHGlobal

• 0x44766c OleUninitialize

• 0x447670 CoFreeUnusedLibraries

• 0x447674 OleInitialize

• 0x447678 CoRevokeClassObject

• 0x44767c OleIsCurrentClipboard

Library KERNEL32.dll:

• 0x4470e8 GetCurrentThread

• 0x4470ec FileTimeToSystemTime

• 0x4470f0 FileTimeToLocalFileTime

• 0x4470f4 InitializeCriticalSection

• 0x4470f8 DeleteCriticalSection

• 0x4470fc EnterCriticalSection

• 0x447100 LeaveCriticalSection

• 0x447104 LocalAlloc

• 0x447108 GlobalFlags

• 0x44710c TlsGetValue

• 0x447110 GlobalReAlloc

• 0x447114 GlobalHandle

• 0x447118 TlsAlloc

• 0x44711c TlsSetValue

• 0x447120 LocalReAlloc

• 0x447124 TlsFree

• 0x447128 InterlockedIncrement

• 0x44712c GetCPInfo

• 0x447130 GetOEMCP

• 0x447134 GetModuleHandleW

• 0x447138 SetErrorMode

• 0x44713c GetFileAttributesA

• 0x447140 GetFileSizeEx

• 0x447144 GetFileTime

• 0x447148 GetTickCount

• 0x44714c RtlUnwind

• 0x447150 ConvertDefaultLocale

• 0x447154 UnhandledExceptionFilter

• 0x447158 SetUnhandledExceptionFilter

• 0x44715c IsDebuggerPresent

• 0x447160 RaiseException

• 0x447164 ExitThread

• 0x447168 CreateThread

• 0x44716c ExitProcess

• 0x447170 GetCommandLineA

• 0x447174 GetStartupInfoA

• 0x447178 HeapAlloc

• 0x44717c HeapFree

• 0x447180 VirtualProtect

• 0x447184 VirtualAlloc

• 0x447188 VirtualQuery

• 0x44718c HeapReAlloc

• 0x447190 SetStdHandle

• 0x447194 GetFileType

• 0x447198 HeapSize

• 0x44719c SetHandleCount

• 0x4471a0 GetStdHandle

• 0x4471a4 InitializeCriticalSectionAndSpinCount

• 0x4471a8 GetTimeZoneInformation

• 0x4471ac GetACP

• 0x4471b0 IsValidCodePage

• 0x4471b4 FreeEnvironmentStringsA

• 0x4471b8 GetEnvironmentStrings

• 0x4471bc FreeEnvironmentStringsW

• 0x4471c0 GetEnvironmentStringsW

• 0x4471c4 HeapCreate

• 0x4471c8 VirtualFree

• 0x4471cc QueryPerformanceCounter

• 0x4471d0 GetSystemTimeAsFileTime

• 0x4471d4 GetConsoleCP

• 0x4471d8 GetConsoleMode

• 0x4471dc GetStringTypeA

• 0x4471e0 GetStringTypeW

• 0x4471e4 LCMapStringA

• 0x4471e8 LCMapStringW

• 0x4471ec WriteConsoleA

• 0x4471f0 GetConsoleOutputCP

• 0x4471f4 WriteConsoleW

• 0x4471f8 GetProcessHeap

• 0x4471fc CompareStringW

• 0x447200 SetEnvironmentVariableA

• 0x447204 EnumResourceLanguagesA

• 0x447208 GetLocaleInfoA

• 0x44720c InterlockedExchange

• 0x447210 lstrcmpA

• 0x447214 SuspendThread

• 0x447218 SetThreadPriority

• 0x44721c CreateFileA

• 0x447220 GetFullPathNameA

• 0x447224 GetVolumeInformationA

• 0x447228 FindFirstFileA

• 0x44722c FindClose

• 0x447230 DuplicateHandle

• 0x447234 GetFileSize

• 0x447238 SetEndOfFile

• 0x44723c UnlockFile

• 0x447240 LockFile

• 0x447244 FlushFileBuffers

• 0x447248 SetFilePointer

• 0x44724c WriteFile

• 0x447250 ReadFile

• 0x447254 GetThreadLocale

• 0x447258 MoveFileA

• 0x44725c GetCurrentProcessId

• 0x447260 FormatMessageA

• 0x447264 LocalFree

• 0x447268 GetCurrentThreadId

• 0x44726c GlobalGetAtomNameA

• 0x447270 GlobalAddAtomA

• 0x447274 GlobalFindAtomA

• 0x447278 GlobalDeleteAtom

• 0x44727c CompareStringA

• 0x447280 lstrcmpW

• 0x447284 InterlockedDecrement

• 0x447288 GetModuleFileNameW

• 0x44728c lstrlenA

• 0x447290 GetSystemTime

• 0x447294 CreateDirectoryA

• 0x447298 WritePrivateProfileStructA

• 0x44729c GetPrivateProfileStructA

• 0x4472a0 GetLocalTime

• 0x4472a4 GetSystemInfo

• 0x4472a8 GetWindowsDirectoryA

• 0x4472ac SetLastError

• 0x4472b0 MultiByteToWideChar

• 0x4472b4 GetModuleFileNameA

• 0x4472b8 GetCurrentProcess

• 0x4472bc CopyFileA

• 0x4472c0 Sleep

• 0x4472c4 MoveFileExA

• 0x4472c8 LoadLibraryA

• 0x4472cc FreeLibrary

• 0x4472d0 GetVersionExA

• 0x4472d4 CreateMutexA

• 0x4472d8 ReleaseMutex

• 0x4472dc GetPrivateProfileStringA

• 0x4472e0 GetPrivateProfileIntA

• 0x4472e4 WritePrivateProfileStringA

• 0x4472e8 TerminateThread

• 0x4472ec GetExitCodeThread

• 0x4472f0 WinExec

• 0x4472f4 GetSystemDirectoryA

• 0x4472f8 GetLastError

• 0x4472fc CreateProcessA

• 0x447300 DeleteFileA

• 0x447304 FreeResource

• 0x447308 GlobalLock

• 0x44730c GlobalUnlock

• 0x447310 GlobalFree

• 0x447314 MulDiv

• 0x447318 CreateEventA

• 0x44731c ResumeThread

• 0x447320 GlobalAlloc

• 0x447324 SetEvent

• 0x447328 WaitForSingleObject

• 0x44732c CloseHandle

• 0x447330 ResetEvent

• 0x447334 WideCharToMultiByte

• 0x447338 FindResourceA

• 0x44733c LoadResource

• 0x447340 LockResource

• 0x447344 SizeofResource

• 0x447348 GetModuleHandleA

• 0x44734c GetProcAddress

• 0x447350 TerminateProcess

Library USER32.dll:

• 0x4473c4 GetSysColorBrush

• 0x4473c8 SetCapture

• 0x4473cc ReleaseCapture

• 0x4473d0 CharNextA

• 0x4473d4 CopyAcceleratorTableA

• 0x4473d8 IsRectEmpty

• 0x4473dc InvalidateRgn

• 0x4473e0 GetNextDlgGroupItem

• 0x4473e4 MessageBeep

• 0x4473e8 RegisterClipboardFormatA

• 0x4473ec PostThreadMessageA

• 0x4473f0 SetMenuItemBitmaps

• 0x4473f4 GetMenuCheckMarkDimensions

• 0x4473f8 LoadBitmapA

• 0x4473fc ModifyMenuA

• 0x447400 GetMenuState

• 0x447404 EnableMenuItem

• 0x447408 CheckMenuItem

• 0x44740c RegisterWindowMessageA

• 0x447410 WinHelpA

• 0x447414 IsChild

• 0x447418 GetCapture

• 0x44741c SetWindowsHookExA

• 0x447420 CallNextHookEx

• 0x447424 GetClassLongA

• 0x447428 GetClassNameA

• 0x44742c SetPropA

• 0x447430 GetPropA

• 0x447434 RemovePropA

• 0x447438 GetForegroundWindow

• 0x44743c GetLastActivePopup

• 0x447440 DispatchMessageA

• 0x447444 GetTopWindow

• 0x447448 GetMessageTime

• 0x44744c GetMessagePos

• 0x447450 PeekMessageA

• 0x447454 MapWindowPoints

• 0x447458 GetKeyState

• 0x44745c SetMenu

• 0x447460 IsWindowVisible

• 0x447464 UpdateWindow

• 0x447468 GetSubMenu

• 0x44746c GetMenuItemID

• 0x447470 GetMenuItemCount

• 0x447474 MessageBoxA

• 0x447478 CreateWindowExA

• 0x44747c GetClassInfoExA

• 0x447480 GetClassInfoA

• 0x447484 RegisterClassA

• 0x447488 AdjustWindowRectEx

• 0x44748c UnregisterClassA

• 0x447490 DefWindowProcA

• 0x447494 CallWindowProcA

• 0x447498 PtInRect

• 0x44749c GetMenu

• 0x4474a0 OffsetRect

• 0x4474a4 IntersectRect

• 0x4474a8 SystemParametersInfoA

• 0x4474ac GetWindowPlacement

• 0x4474b0 GetWindowRect

• 0x4474b4 EndPaint

• 0x4474b8 BeginPaint

• 0x4474bc GetWindowDC

• 0x4474c0 ScreenToClient

• 0x4474c4 GrayStringA

• 0x4474c8 DrawTextExA

• 0x4474cc DrawTextA

• 0x4474d0 TabbedTextOutA

• 0x4474d4 UnhookWindowsHookEx

• 0x4474d8 GetWindowTextA

• 0x4474dc GetFocus

• 0x4474e0 SetWindowPos

• 0x4474e4 SetFocus

• 0x4474e8 MoveWindow

• 0x4474ec GetDlgCtrlID

• 0x4474f0 SetWindowTextA

• 0x4474f4 IsDialogMessageA

• 0x4474f8 SendDlgItemMessageA

• 0x4474fc GetWindow

• 0x447500 GetDesktopWindow

• 0x447504 GetActiveWindow

• 0x447508 DestroyMenu

• 0x44750c SetActiveWindow

• 0x447510 CreateDialogIndirectParamA

• 0x447514 DestroyWindow

• 0x447518 GetDlgItem

• 0x44751c IsWindowEnabled

• 0x447520 GetParent

• 0x447524 GetNextDlgTabItem

• 0x447528 EndDialog

• 0x44752c GetSystemMetrics

• 0x447530 LoadIconA

• 0x447534 IsIconic

• 0x447538 GetSystemMenu

• 0x44753c AppendMenuA

• 0x447540 DrawIcon

• 0x447544 FindWindowA

• 0x447548 ShowWindow

• 0x44754c SetForegroundWindow

• 0x447550 SetCursor

• 0x447554 LoadCursorA

• 0x447558 SetWindowContextHelpId

• 0x44755c MapDialogRect

• 0x447560 PostQuitMessage

• 0x447564 GetMessageA

• 0x447568 KillTimer

• 0x44756c SetTimer

• 0x447570 SetRect

• 0x447574 CopyRect

• 0x447578 GetDC

• 0x44757c ReleaseDC

• 0x447580 GetSysColor

• 0x447584 FillRect

• 0x447588 SendMessageA

• 0x44758c LoadImageA

• 0x447590 IsWindow

• 0x447594 EnableWindow

• 0x447598 InvalidateRect

• 0x44759c GetClientRect

• 0x4475a0 PostMessageA

• 0x4475a4 GetWindowLongA

• 0x4475a8 SetWindowLongA

• 0x4475ac RedrawWindow

• 0x4475b0 TranslateMessage

• 0x4475b4 ValidateRect

• 0x4475b8 CharUpperA

• 0x4475bc GetWindowThreadProcessId

• 0x4475c0 GetCursorPos

• 0x4475c4 WindowFromPoint

• 0x4475c8 EqualRect

• 0x4475cc ClientToScreen

Library GDI32.dll:

• 0x447048 SetMapMode

• 0x44704c GetClipBox

• 0x447050 RectVisible

• 0x447054 TextOutA

• 0x447058 ExtTextOutA

• 0x44705c Escape

• 0x447060 SetViewportOrgEx

• 0x447064 OffsetViewportOrgEx

• 0x447068 SetViewportExtEx

• 0x44706c ScaleViewportExtEx

• 0x447070 SetWindowExtEx

• 0x447074 ScaleWindowExtEx

• 0x447078 ExtSelectClipRgn

• 0x44707c CreateBitmap

• 0x447080 GetStockObject

• 0x447084 SetTextColor

• 0x447088 CreateRectRgnIndirect

• 0x44708c GetMapMode

• 0x447090 GetBkColor

• 0x447094 GetTextColor

• 0x447098 GetRgnBox

• 0x44709c GetWindowExtEx

• 0x4470a0 SetBkMode

• 0x4470a4 SetBkColor

• 0x4470a8 RestoreDC

• 0x4470ac SaveDC

• 0x4470b0 CreateFontIndirectA

• 0x4470b4 GetDeviceCaps

• 0x4470b8 CreateSolidBrush

• 0x4470bc CreateCompatibleBitmap

• 0x4470c0 DeleteDC

• 0x4470c4 SelectObject

• 0x4470c8 GetObjectA

• 0x4470cc StretchBlt

• 0x4470d0 BitBlt

• 0x4470d4 CreateCompatibleDC

• 0x4470d8 DeleteObject

• 0x4470dc GetViewportExtEx

• 0x4470e0 PtVisible

Library COMDLG32.dll:

• 0x447040 GetFileTitleA

Library WINSPOOL.DRV:

• 0x447624 DocumentPropertiesA

• 0x447628 OpenPrinterA

• 0x44762c ClosePrinter

Library ADVAPI32.dll:

• 0x447000 RegSetValueExA

• 0x447004 RegCreateKeyExA

• 0x447008 RegQueryValueA

• 0x44700c RegEnumKeyA

• 0x447010 RegDeleteKeyA

• 0x447014 SetSecurityDescriptorDacl

• 0x447018 RegOpenKeyExA

• 0x44701c RegOpenKeyA

• 0x447020 RegQueryInfoKeyA

• 0x447024 RegQueryValueExA

• 0x447028 RegEnumKeyExA

• 0x44702c RegCloseKey

• 0x447030 InitializeSecurityDescriptor

Library SHELL32.dll:

• 0x447394 ShellExecuteExA

• 0x447398 SHGetSpecialFolderPathA

Library COMCTL32.dll:

• 0x447038 _TrackMouseEvent

Library oledlg.dll:

• 0x447684

Library OLEAUT32.dll:

• 0x447358 OleLoadPicture

• 0x44735c SysFreeString

• 0x447360 SysAllocString

• 0x447364 SysStringLen

• 0x447368 VariantClear

• 0x44736c VariantChangeType

• 0x447370 VariantInit

• 0x447374 SysAllocStringLen

• 0x447378 SysAllocStringByteLen

• 0x44737c SafeArrayDestroy

• 0x447380 VariantTimeToSystemTime

• 0x447384 VariantCopy

• 0x447388 SystemTimeToVariantTime

• 0x44738c OleCreateFontIndirect

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	51968	239.255.255.250	1900
192.168.56.101	53238	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.

resource name	IDR_GIF1
resource name	None