1.6
低危
该样本未表现出任何异常！
重新分析
更多

3ce6347b28007263c9a903af4916f2630de6d882774bdb9e81eaeb368d7284f0

4b8194037614dd1235559cbe9e762100.exe

分析耗时

35s

最近分析

文件大小

3.8MB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
This executable has a PDB path (1 个事件)
pdb_path C:\seka\nokusevevalusololo.pdbe\crypt\tmp_116776294\bin\jutir.pdbà+ð`¸‚
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (2 个事件)
Time & API Arguments Status Return Repeated
1620977295.7475
NtProtectVirtualMemory
process_identifier: 1544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 3829760
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x036f0000
success 0 0
1620977295.9665
NtAllocateVirtualMemory
process_identifier: 1544
region_size: 7299072
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x03aa0000
success 0 0
The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)
entropy 7.999468390890028 section {'size_of_data': '0x003b2200', 'virtual_address': '0x00001000', 'entropy': 7.999468390890028, 'name': '.text', 'virtual_size': '0x003b20d0'} description A section with a high entropy has been found
entropy 0.9651874521805662 description Overall entropy of this PE file is high
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2019-08-09 04:02:33

Imports

Library KERNEL32.dll:
• 0x7b4008 FormatMessageA
• 0x7b400c GetCurrencyFormatA
• 0x7b4010 WriteFile
• 0x7b4014 GetLocaleInfoW
• 0x7b4018 GetFileAttributesA
• 0x7b4020 GetProcAddress
• 0x7b4024 LocalAlloc
• 0x7b402c CreateHardLinkW
• 0x7b4030 TransmitCommChar
• 0x7b4034 GetTapeParameters
• 0x7b4038 GetCurrentProcessId
• 0x7b403c LCMapStringW
• 0x7b4040 GetModuleHandleW
• 0x7b4044 SleepEx
• 0x7b4048 FindFirstFileExW
• 0x7b4050 HeapAlloc
• 0x7b4054 FindResourceW
• 0x7b4058 GetLastError
• 0x7b405c lstrlenA
• 0x7b4060 GetCommandLineA
• 0x7b4064 GetStartupInfoA
• 0x7b4068 TerminateProcess
• 0x7b406c GetCurrentProcess
• 0x7b4078 IsDebuggerPresent
• 0x7b407c Sleep
• 0x7b4080 ExitProcess
• 0x7b4084 GetStdHandle
• 0x7b4088 GetModuleFileNameA
• 0x7b4098 WideCharToMultiByte
• 0x7b40a0 SetHandleCount
• 0x7b40a4 GetFileType
• 0x7b40ac TlsGetValue
• 0x7b40b0 TlsAlloc
• 0x7b40b4 TlsSetValue
• 0x7b40b8 TlsFree
• 0x7b40c0 SetLastError
• 0x7b40c4 GetCurrentThreadId
• 0x7b40c8 HeapCreate
• 0x7b40cc VirtualFree
• 0x7b40d0 HeapFree
• 0x7b40d8 GetTickCount
• 0x7b40e0 RaiseException
• 0x7b40ec LoadLibraryA
• 0x7b40f4 GetCPInfo
• 0x7b40f8 GetACP
• 0x7b40fc GetOEMCP
• 0x7b4100 IsValidCodePage
• 0x7b4104 VirtualAlloc
• 0x7b4108 HeapReAlloc
• 0x7b410c RtlUnwind
• 0x7b4110 GetModuleHandleA
• 0x7b4114 HeapSize
• 0x7b4118 GetLocaleInfoA
• 0x7b411c LCMapStringA
• 0x7b4120 MultiByteToWideChar
• 0x7b4124 GetStringTypeA
• 0x7b4128 GetStringTypeW
Library ADVAPI32.dll:

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49713 114.114.114.114 53
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53657 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 49235 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49238 239.255.255.250 1900
192.168.56.101 49714 239.255.255.250 3702
192.168.56.101 53658 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.