SmartHawk

3.4

中危

该样本未表现出任何异常！

重新分析

下载样本

6f3eedae94fd2a42e7fadfcf625e9d221b3533692216942ba806941014f000a3

4498f399c61cae958310e07bf96c5a8e.exe

分析耗时

31s

最近分析

文件大小

198.5KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

This executable has a PDB path (1 个事件)

pdb_path

C:\gifilexiku.pdbserver\runtime\crypt\tmp_39708798\bin\xomidegac.pdb°BôBBBB°

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

MODUXOWEFAZIRUVAX

Allocates read-write-execute memory (usually to unpack itself) (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619384485.9995 NtProtectVirtualMemory	process_identifier: 708 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 45056 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x01b4d000	success	0	0
1619384486.0155 NtAllocateVirtualMemory	process_identifier: 708 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003a0000	success	0	0

Foreign language identified in PE resource (11 个事件)

name

MODUXOWEFAZIRUVAX

language

LANG_PORTUGUESE

offset

0x0169a420

filetype

ASCII text, with very long lines, with no line terminators

sublanguage

SUBLANG_PORTUGUESE_BRAZILIAN

size

0x0000055d

name

RT_ICON

language

LANG_PORTUGUESE

offset

0x01699f50

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_PORTUGUESE_BRAZILIAN

size

0x00000468

name

RT_ICON

language

LANG_PORTUGUESE

offset

0x01699f50

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_PORTUGUESE_BRAZILIAN

size

0x00000468

name

RT_ICON

language

LANG_PORTUGUESE

offset

0x01699f50

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_PORTUGUESE_BRAZILIAN

size

0x00000468

name

RT_ICON

language

LANG_PORTUGUESE

offset

0x01699f50

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_PORTUGUESE_BRAZILIAN

size

0x00000468

name

RT_ICON

language

LANG_PORTUGUESE

offset

0x01699f50

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_PORTUGUESE_BRAZILIAN

size

0x00000468

name

RT_ICON

language

LANG_PORTUGUESE

offset

0x01699f50

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_PORTUGUESE_BRAZILIAN

size

0x00000468

name

RT_ICON

language

LANG_PORTUGUESE

offset

0x01699f50

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_PORTUGUESE_BRAZILIAN

size

0x00000468

name

RT_DIALOG

language

LANG_PORTUGUESE

offset

0x0169a980

filetype

data

sublanguage

SUBLANG_PORTUGUESE_BRAZILIAN

size

0x00000094

name

RT_GROUP_ICON

language

LANG_PORTUGUESE

offset

0x0169a3b8

filetype

data

sublanguage

SUBLANG_PORTUGUESE_BRAZILIAN

size

0x00000068

name

RT_VERSION

language

LANG_PORTUGUESE

offset

0x0169aa18

filetype

data

sublanguage

SUBLANG_PORTUGUESE_BRAZILIAN

size

0x00000164

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.32675678754657

section

{'size_of_data': '0x00024200', 'virtual_address': '0x00001000', 'entropy': 7.32675678754657, 'name': '.text', 'virtual_size': '0x0002414e'}

description

A section with a high entropy has been found

entropy

0.7316455696202532

description

Overall entropy of this PE file is high

Generates some ICMP traffic

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.24.14:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2019-10-22 08:32:19

Imports

Library KERNEL32.dll:

• 0x426000 CreateHardLinkA

• 0x426004 FindNextVolumeMountPointA

• 0x426008 FormatMessageA

• 0x42600c GetUserGeoID

• 0x426010 GetCurrencyFormatW

• 0x426014 ReadFile

• 0x426018 lstrlenW

• 0x42601c IsBadStringPtrA

• 0x426020 SetConsoleTitleA

• 0x426024 WritePrivateProfileStringW

• 0x426028 ReplaceFileA

• 0x42602c GetTempPathW

• 0x426030 LCMapStringA

• 0x426034 GetTapeStatus

• 0x426038 GlobalFree

• 0x42603c OpenWaitableTimerA

• 0x426040 LoadLibraryA

• 0x426044 GetProcessWorkingSetSize

• 0x426048 LocalAlloc

• 0x42604c GetProcessAffinityMask

• 0x426050 VirtualProtect

• 0x426054 OpenFileMappingA

• 0x426058 SetComputerNameW

• 0x42605c GetUserDefaultLCID

• 0x426060 GlobalAddAtomA

• 0x426064 DebugActiveProcessStop

• 0x426068 GetCommandLineW

• 0x42606c InterlockedIncrement

• 0x426070 InterlockedDecrement

• 0x426074 Sleep

• 0x426078 InitializeCriticalSection

• 0x42607c DeleteCriticalSection

• 0x426080 EnterCriticalSection

• 0x426084 LeaveCriticalSection

• 0x426088 GetLastError

• 0x42608c HeapFree

• 0x426090 TerminateProcess

• 0x426094 GetCurrentProcess

• 0x426098 UnhandledExceptionFilter

• 0x42609c SetUnhandledExceptionFilter

• 0x4260a0 IsDebuggerPresent

• 0x4260a4 GetCommandLineA

• 0x4260a8 GetStartupInfoA

• 0x4260ac RtlUnwind

• 0x4260b0 RaiseException

• 0x4260b4 WideCharToMultiByte

• 0x4260b8 MultiByteToWideChar

• 0x4260bc LCMapStringW

• 0x4260c0 GetCPInfo

• 0x4260c4 HeapAlloc

• 0x4260c8 HeapCreate

• 0x4260cc VirtualFree

• 0x4260d0 VirtualAlloc

• 0x4260d4 HeapReAlloc

• 0x4260d8 GetModuleHandleW

• 0x4260dc GetProcAddress

• 0x4260e0 TlsGetValue

• 0x4260e4 TlsAlloc

• 0x4260e8 TlsSetValue

• 0x4260ec TlsFree

• 0x4260f0 SetLastError

• 0x4260f4 GetCurrentThreadId

• 0x4260f8 ExitProcess

• 0x4260fc WriteFile

• 0x426100 GetStdHandle

• 0x426104 GetModuleFileNameA

• 0x426108 FreeEnvironmentStringsA

• 0x42610c GetEnvironmentStrings

• 0x426110 FreeEnvironmentStringsW

• 0x426114 GetEnvironmentStringsW

• 0x426118 SetHandleCount

• 0x42611c GetFileType

• 0x426120 QueryPerformanceCounter

• 0x426124 GetTickCount

• 0x426128 GetCurrentProcessId

• 0x42612c GetSystemTimeAsFileTime

• 0x426130 HeapSize

• 0x426134 GetACP

• 0x426138 GetOEMCP

• 0x42613c IsValidCodePage

• 0x426140 GetLocaleInfoA

• 0x426144 EnumSystemLocalesA

• 0x426148 IsValidLocale

• 0x42614c GetStringTypeA

• 0x426150 GetStringTypeW

• 0x426154 InitializeCriticalSectionAndSpinCount

• 0x426158 GetLocaleInfoW

• 0x42615c GetModuleHandleA

• 0x426160 GetConsoleCP

• 0x426164 GetConsoleMode

• 0x426168 FlushFileBuffers

• 0x42616c CloseHandle

• 0x426170 WriteConsoleA

• 0x426174 GetConsoleOutputCP

• 0x426178 WriteConsoleW

• 0x42617c SetFilePointer

• 0x426180 SetStdHandle

• 0x426184 CreateFileA

Library USER32.dll:

• 0x42618c GetCursor

Exports

Ordinal	Address	Name
1	0x422927	gandball

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	216.58.200.46
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49236	239.255.255.250	3702
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	57875	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62194	239.255.255.250	1900
192.168.56.101	51963	8.8.8.8	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.