SmartHawk

5.0

中危

15 个模型检测该样本为恶意！

重新分析

下载样本

855052b72f4fdc5a89febe67c14f1f15dce63ea429443873b365cbd409ac357e

47cdcb062845fde52d8b20a20fb6d232.exe

分析耗时

90s

最近分析

文件大小

3.6MB

静态报毒动态报毒 AGENTCRT CLOD319 CONFIDENCE MODERATE CONFIDENCE MUYJD STRICTOR

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
Baidu		20170527	1.0.0.2
Avast		20170529	8.0.1489.320
Tencent		20170529	1.0.0.1
Kingsoft		20170529	2013.8.14.323
McAfee		20170529	6.0.6.653
CrowdStrike	malicious_confidence_90% (D)	20170420	1.0

This executable is signed

This executable has a PDB path (1 个事件)

pdb_path

e:\eç æ·è´\æ¸¸æççæ¬\youxun\trunk\bin\Win32\Release\build\apkpackage\apk.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620946614.314036 GlobalMemoryStatusEx		success	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

EXE

Foreign language identified in PE resource (18 个事件)

name

EXE

language

LANG_CHINESE

offset

0x00379388

filetype

ISO-8859 text, with no line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000bc

name

EXE

language

LANG_CHINESE

offset

0x00379388

filetype

ISO-8859 text, with no line terminators

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x000000bc

name

RT_ICON

language

LANG_CHINESE

offset

0x00389cac

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00389cac

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00389cac

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00389cac

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00389cac

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00389cac

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00389cac

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00389cac

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00389cac

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_ICON

language

LANG_CHINESE

offset

0x00389cac

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000468

name

RT_MENU

language

LANG_CHINESE

offset

0x0038a114

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000050

name

RT_STRING

language

LANG_CHINESE

offset

0x0038a164

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000034

name

RT_ACCELERATOR

language

LANG_CHINESE

offset

0x0038a198

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000010

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x0038a1f4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000004c

name

RT_GROUP_ICON

language

LANG_CHINESE

offset

0x0038a1f4

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x0000004c

name

RT_VERSION

language

LANG_CHINESE

offset

0x0038a240

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

size

0x00000260

Creates executable files on the filesystem (5 个事件)

file	C:\ProgramData\wdgame\aapt.exe
file	C:\ProgramData\wdgame\winrar.exe
file	C:\ProgramData\wdgame\glut.dll
file	C:\ProgramData\wdgame\glut32.dll
file	C:\ProgramData\wdgame\MountBS.exe

Drops a binary and executes it (1 个事件)

file	C:\ProgramData\wdgame\MountBS.exe

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620975660.27625 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.986647009595144

section

{'size_of_data': '0x00352800', 'virtual_address': '0x00038000', 'entropy': 7.986647009595144, 'name': '.rsrc', 'virtual_size': '0x00352730'}

description

A section with a high entropy has been found

entropy

0.9339739190116678

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620975664.52625 LookupPrivilegeValueW	system_name: privilege_name: SeDebugPrivilege	success	1	0

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 个事件)

Bkav	W32.Clod319.Trojan.f1d4
MicroWorld-eScan	Gen:Variant.Strictor.134218
ALYac	Gen:Variant.Strictor.134218
Zillya	Adware.AgentCRT.Win32.494
ClamAV	Win.Trojan.Downloader-65962
GData	Gen:Variant.Strictor.134218
BitDefender	Gen:Variant.Strictor.134218
Endgame	malicious (moderate confidence)
Emsisoft	Gen:Variant.Strictor.134218 (B)
F-Secure	Gen:Variant.Strictor.134218
Avira	TR/Agent.muyjd
Arcabit	Trojan.Strictor.D20C4A
Fortinet	W32/Generic.AC.38C494!tr
Ad-Aware	Gen:Variant.Strictor.134218
CrowdStrike	malicious_confidence_90% (D)

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1620975662.90125 RegSetValueExA	key_handle: 0x000003ec value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1620975662.90125 RegSetValueExA	key_handle: 0x000003ec value: ØHH× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1620975662.90125 RegSetValueExA	key_handle: 0x000003ec value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1620975662.90125 RegSetValueExW	key_handle: 0x000003ec value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1620975662.91725 RegSetValueExA	key_handle: 0x00000408 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1620975662.91725 RegSetValueExA	key_handle: 0x00000408 value: ØHH× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1620975662.91725 RegSetValueExA	key_handle: 0x00000408 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1620975663.01125 RegSetValueExW	key_handle: 0x000003e8 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2015-01-23 16:48:14

Imports

Library KERNEL32.dll:

• 0x428060 GetStartupInfoW

• 0x428064 HeapFree

• 0x428068 HeapAlloc

• 0x42806c ExitProcess

• 0x428070 UnhandledExceptionFilter

• 0x428074 SetUnhandledExceptionFilter

• 0x428078 IsDebuggerPresent

• 0x42807c RtlUnwind

• 0x428080 RaiseException

• 0x428084 HeapReAlloc

• 0x428088 SetStdHandle

• 0x42808c GetFileType

• 0x428090 HeapSize

• 0x428094 GetStdHandle

• 0x428098 GetModuleFileNameA

• 0x42809c FreeEnvironmentStringsW

• 0x4280a0 GetEnvironmentStringsW

• 0x4280a4 GetCommandLineW

• 0x4280a8 SetHandleCount

• 0x4280ac GetStartupInfoA

• 0x4280b0 HeapCreate

• 0x4280b4 VirtualFree

• 0x4280b8 QueryPerformanceCounter

• 0x4280bc GetSystemTimeAsFileTime

• 0x4280c0 VirtualAlloc

• 0x4280c4 GetCPInfo

• 0x4280c8 GetACP

• 0x4280cc GetOEMCP

• 0x4280d0 IsValidCodePage

• 0x4280d4 LCMapStringW

• 0x4280d8 InitializeCriticalSectionAndSpinCount

• 0x4280dc GetTimeZoneInformation

• 0x4280e0 GetConsoleCP

• 0x4280e4 GetConsoleMode

• 0x4280e8 LCMapStringA

• 0x4280ec GetStringTypeA

• 0x4280f0 GetStringTypeW

• 0x4280f4 GetLocaleInfoA

• 0x4280f8 CreateFileA

• 0x4280fc GetCurrentDirectoryA

• 0x428100 GetDriveTypeA

• 0x428104 WriteConsoleA

• 0x428108 GetConsoleOutputCP

• 0x42810c WriteConsoleW

• 0x428110 SetEnvironmentVariableA

• 0x428114 GlobalFindAtomW

• 0x428118 GlobalDeleteAtom

• 0x42811c LoadLibraryA

• 0x428120 GetVersionExA

• 0x428124 GetModuleHandleA

• 0x428128 GlobalAddAtomW

• 0x42812c GetCurrentThreadId

• 0x428130 GlobalFlags

• 0x428134 lstrcmpW

• 0x428138 CompareStringW

• 0x42813c InterlockedIncrement

• 0x428140 TlsFree

• 0x428144 LocalReAlloc

• 0x428148 TlsSetValue

• 0x42814c TlsAlloc

• 0x428150 GlobalHandle

• 0x428154 GlobalReAlloc

• 0x428158 TlsGetValue

• 0x42815c GetCurrentProcessId

• 0x428160 GetFullPathNameW

• 0x428164 FlushFileBuffers

• 0x428168 CompareStringA

• 0x42816c InterlockedExchange

• 0x428170 InterlockedDecrement

• 0x428174 GetModuleFileNameW

• 0x428178 GetModuleHandleW

• 0x42817c FindNextFileW

• 0x428180 lstrcmpA

• 0x428184 GlobalFree

• 0x428188 GlobalAlloc

• 0x42818c GlobalLock

• 0x428190 GlobalUnlock

• 0x428194 FormatMessageW

• 0x428198 LocalFree

• 0x42819c LocalAlloc

• 0x4281a0 FreeLibrary

• 0x4281a4 LeaveCriticalSection

• 0x4281a8 EnterCriticalSection

• 0x4281ac DeleteCriticalSection

• 0x4281b0 InitializeCriticalSection

• 0x4281b4 SetLastError

• 0x4281b8 FileTimeToLocalFileTime

• 0x4281bc FindClose

• 0x4281c0 FindFirstFileW

• 0x4281c4 FileTimeToSystemTime

• 0x4281c8 UnmapViewOfFile

• 0x4281cc LocalFileTimeToFileTime

• 0x4281d0 GetCurrentDirectoryW

• 0x4281d4 ReadFile

• 0x4281d8 SetFileTime

• 0x4281dc SystemTimeToFileTime

• 0x4281e0 SetFilePointer

• 0x4281e4 DeleteFileW

• 0x4281e8 CloseHandle

• 0x4281ec WritePrivateProfileStringW

• 0x4281f0 lstrlenW

• 0x4281f4 CreateFileW

• 0x4281f8 TerminateProcess

• 0x4281fc GetFileAttributesW

• 0x428200 Sleep

• 0x428204 WriteFile

• 0x428208 WaitForSingleObject

• 0x42820c CreateDirectoryW

• 0x428210 GetCurrentProcess

• 0x428214 WideCharToMultiByte

• 0x428218 GetProcAddress

• 0x42821c LoadLibraryW

• 0x428220 GetTickCount

• 0x428224 lstrlenA

• 0x428228 LockResource

• 0x42822c GetLastError

• 0x428230 MultiByteToWideChar

• 0x428234 SizeofResource

• 0x428238 LoadResource

• 0x42823c FindResourceW

Library USER32.dll:

• 0x428264 DestroyMenu

• 0x428268 SetMenuItemBitmaps

• 0x42826c GetMenuCheckMarkDimensions

• 0x428270 LoadBitmapW

• 0x428274 ModifyMenuW

• 0x428278 EnableMenuItem

• 0x42827c CheckMenuItem

• 0x428280 RegisterWindowMessageW

• 0x428284 WinHelpW

• 0x428288 GetCapture

• 0x42828c GetClassLongW

• 0x428290 SetPropW

• 0x428294 GetPropW

• 0x428298 RemovePropW

• 0x42829c GetForegroundWindow

• 0x4282a0 GetTopWindow

• 0x4282a4 GetMessageTime

• 0x4282a8 GetMessagePos

• 0x4282ac MapWindowPoints

• 0x4282b0 SetMenu

• 0x4282b4 SetForegroundWindow

• 0x4282b8 GetClientRect

• 0x4282bc PostMessageW

• 0x4282c0 CreateWindowExW

• 0x4282c4 GetClassInfoExW

• 0x4282c8 GetClassInfoW

• 0x4282cc RegisterClassW

• 0x4282d0 AdjustWindowRectEx

• 0x4282d4 CopyRect

• 0x4282d8 CallWindowProcW

• 0x4282dc GetMenu

• 0x4282e0 SystemParametersInfoA

• 0x4282e4 IsIconic

• 0x4282e8 GrayStringW

• 0x4282ec DrawTextExW

• 0x4282f0 DrawTextW

• 0x4282f4 TabbedTextOutW

• 0x4282f8 SetWindowsHookExW

• 0x4282fc CallNextHookEx

• 0x428300 GetKeyState

• 0x428304 PeekMessageW

• 0x428308 ValidateRect

• 0x42830c SetWindowPos

• 0x428310 SetWindowLongW

• 0x428314 IsWindow

• 0x428318 GetDlgItem

• 0x42831c GetFocus

• 0x428320 ClientToScreen

• 0x428324 GetWindow

• 0x428328 GetDlgCtrlID

• 0x42832c GetWindowRect

• 0x428330 GetClassNameW

• 0x428334 PtInRect

• 0x428338 SetWindowTextW

• 0x42833c GetDC

• 0x428340 ReleaseDC

• 0x428344 GetSysColor

• 0x428348 GetSysColorBrush

• 0x42834c GetWindowThreadProcessId

• 0x428350 SendMessageW

• 0x428354 GetParent

• 0x428358 GetWindowLongW

• 0x42835c GetLastActivePopup

• 0x428360 IsWindowEnabled

• 0x428364 EnableWindow

• 0x428368 MessageBoxW

• 0x42836c GetWindowTextW

• 0x428370 GetSystemMetrics

• 0x428374 UnhookWindowsHookEx

• 0x428378 GetMenuState

• 0x42837c GetMenuItemID

• 0x428380 GetMenuItemCount

• 0x428384 GetSubMenu

• 0x428388 EndPaint

• 0x42838c DestroyWindow

• 0x428390 PostQuitMessage

• 0x428394 DialogBoxParamW

• 0x428398 LoadCursorW

• 0x42839c BeginPaint

• 0x4283a0 wsprintfW

• 0x4283a4 RegisterClassExW

• 0x4283a8 LoadIconW

• 0x4283ac EndDialog

• 0x4283b0 LoadStringW

• 0x4283b4 DefWindowProcW

• 0x4283b8 DispatchMessageW

• 0x4283bc GetWindowPlacement

Library GDI32.dll:

• 0x428000 GetStockObject

• 0x428004 SelectObject

• 0x428008 CreateBitmap

• 0x42800c DeleteDC

• 0x428010 ScaleWindowExtEx

• 0x428014 SetWindowExtEx

• 0x428018 ScaleViewportExtEx

• 0x42801c SetViewportExtEx

• 0x428020 OffsetViewportOrgEx

• 0x428024 GetDeviceCaps

• 0x428028 Escape

• 0x42802c ExtTextOutW

• 0x428030 TextOutW

• 0x428034 RectVisible

• 0x428038 PtVisible

• 0x42803c GetClipBox

• 0x428040 SetMapMode

• 0x428044 SetTextColor

• 0x428048 SetBkColor

• 0x42804c RestoreDC

• 0x428050 SaveDC

• 0x428054 DeleteObject

• 0x428058 SetViewportOrgEx

Library WINSPOOL.DRV:

• 0x4283c4 OpenPrinterW

• 0x4283c8 ClosePrinter

• 0x4283cc DocumentPropertiesW

Library SHELL32.dll:

• 0x428254 SHGetSpecialFolderLocation

• 0x428258 SHGetPathFromIDListW

• 0x42825c ShellExecuteW

Library ole32.dll:

• 0x4283d4 CoTaskMemFree

Library OLEAUT32.dll:

• 0x428244 VariantInit

• 0x428248 VariantClear

• 0x42824c VariantChangeType

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
tongji.ziyuan.yxdown.com	A 114.80.100.57	114.80.100.57
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.