SmartHawk

1.6

低危

1 个模型检测该样本为恶意！

重新分析

下载样本

af595d00fddb085aab5e09951df6c77a9cbf9e093f16d04578f08323ccb56c35

4d1c5e72d2d84804d9b4dce4064b43b0.exe

分析耗时

22s

查杀引擎	查杀结果	查杀时间	查杀版本
Baidu		20180131	1.0.0.2
Avast		20180131	17.9.3761.0
Tencent	Suspicious.Heuristic.Gen.b.0	20180131	1.0.0.1
Kingsoft		20180131	2013.8.14.323
McAfee		20180131	6.0.6.653
CrowdStrike		20170201	1.0

Time & API	Arguments	Status	Return	Repeated
1620946608.000205 RegOpenKeyExW	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NVIDIA nView Desktop Manager regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\NVIDIA nView Desktop Manager options: 0	failed	2	0
1620946608.000205 RegOpenKeyExW	access: 0x00020019 base_handle: 0x80000002 key_handle: 0x00000000 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView options: 0	failed	2	0

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2012-12-01 11:20:52

Imports

Library COMCTL32.dll:

• 0x433074 PropertySheetW

• 0x433078 CreatePropertySheetPageW

Library VERSION.dll:

• 0x43337c GetFileVersionInfoW

• 0x433380 VerQueryValueW

• 0x433384 GetFileVersionInfoSizeW

Library KERNEL32.dll:

• 0x4330e0 GetSystemDirectoryW

• 0x4330e4 ReadFile

• 0x4330e8 FlushFileBuffers

• 0x4330ec CreateFileA

• 0x4330f0 WriteConsoleW

• 0x4330f4 GetConsoleOutputCP

• 0x4330f8 WriteConsoleA

• 0x4330fc SetStdHandle

• 0x433100 HeapSize

• 0x433104 GetLocaleInfoA

• 0x433108 GetStringTypeW

• 0x43310c GetStringTypeA

• 0x433110 LCMapStringA

• 0x433114 LoadLibraryA

• 0x433118 InitializeCriticalSectionAndSpinCount

• 0x43311c GetConsoleMode

• 0x433120 GetConsoleCP

• 0x433124 GetSystemTimeAsFileTime

• 0x433128 GetCurrentProcessId

• 0x43312c GetTickCount

• 0x433130 QueryPerformanceCounter

• 0x433134 GetFileType

• 0x433138 SetHandleCount

• 0x43313c GetEnvironmentStringsW

• 0x433140 FreeEnvironmentStringsW

• 0x433144 GetEnvironmentStrings

• 0x433148 FreeEnvironmentStringsA

• 0x43314c LCMapStringW

• 0x433150 GetModuleHandleA

• 0x433154 GetCurrentThreadId

• 0x433158 SetLastError

• 0x43315c TlsFree

• 0x433160 TlsSetValue

• 0x433164 TlsAlloc

• 0x433168 TlsGetValue

• 0x43316c IsValidCodePage

• 0x433170 GetOEMCP

• 0x433174 GetACP

• 0x433178 InterlockedDecrement

• 0x43317c InterlockedIncrement

• 0x433180 GetCPInfo

• 0x433184 GetModuleFileNameA

• 0x433188 GetStdHandle

• 0x43318c WriteFile

• 0x433190 ExitProcess

• 0x433194 GetCommandLineW

• 0x433198 WaitForSingleObject

• 0x43319c ReleaseMutex

• 0x4331a0 DeleteFileW

• 0x4331a4 GetSystemWow64DirectoryW

• 0x4331a8 FindFirstFileW

• 0x4331ac FindNextFileW

• 0x4331b0 FindClose

• 0x4331b4 RemoveDirectoryW

• 0x4331b8 SetFileAttributesW

• 0x4331bc MoveFileExW

• 0x4331c0 GetWindowsDirectoryW

• 0x4331c4 CreateFileW

• 0x4331c8 GetFileSize

• 0x4331cc CreateFileMappingW

• 0x4331d0 MapViewOfFile

• 0x4331d4 UnmapViewOfFile

• 0x4331d8 SetFilePointer

• 0x4331dc SetEndOfFile

• 0x4331e0 CreateProcessW

• 0x4331e4 GetExitCodeProcess

• 0x4331e8 CloseHandle

• 0x4331ec GetCurrentThread

• 0x4331f0 LocalAlloc

• 0x4331f4 LocalFree

• 0x4331f8 GetCurrentProcess

• 0x4331fc lstrcmpiW

• 0x433200 lstrcmpA

• 0x433204 WideCharToMultiByte

• 0x433208 GetUserDefaultLCID

• 0x43320c GetUserDefaultLangID

• 0x433210 GlobalAlloc

• 0x433214 GlobalLock

• 0x433218 GlobalUnlock

• 0x43321c GlobalFree

• 0x433220 GetVersionExW

• 0x433224 Sleep

• 0x433228 lstrlenW

• 0x43322c CreateMutexW

• 0x433230 GetLastError

• 0x433234 lstrcmpW

• 0x433238 LoadLibraryW

• 0x43323c OutputDebugStringW

• 0x433240 MultiByteToWideChar

• 0x433244 GetModuleHandleW

• 0x433248 GetProcAddress

• 0x43324c FreeLibrary

• 0x433250 HeapCreate

• 0x433254 HeapReAlloc

• 0x433258 VirtualAlloc

• 0x43325c VirtualFree

• 0x433260 EnterCriticalSection

• 0x433264 HeapAlloc

• 0x433268 HeapFree

• 0x43326c RtlUnwind

• 0x433270 RaiseException

• 0x433274 GetCommandLineA

• 0x433278 GetStartupInfoA

• 0x43327c TerminateProcess

• 0x433280 UnhandledExceptionFilter

• 0x433284 SetUnhandledExceptionFilter

• 0x433288 IsDebuggerPresent

• 0x43328c DeleteCriticalSection

• 0x433290 LeaveCriticalSection

Library USER32.dll:

• 0x4332a0 CheckRadioButton

• 0x4332a4 SetWindowLongW

• 0x4332a8 IsDlgButtonChecked

• 0x4332ac PostMessageW

• 0x4332b0 FindWindowExW

• 0x4332b4 IsWindowVisible

• 0x4332b8 PostQuitMessage

• 0x4332bc PtInRect

• 0x4332c0 MessageBoxW

• 0x4332c4 SystemParametersInfoW

• 0x4332c8 ReleaseDC

• 0x4332cc SendDlgItemMessageW

• 0x4332d0 ExitWindowsEx

• 0x4332d4 GetClassNameW

• 0x4332d8 MapWindowPoints

• 0x4332dc MapDialogRect

• 0x4332e0 InvalidateRect

• 0x4332e4 CallWindowProcW

• 0x4332e8 LoadImageW

• 0x4332ec DestroyWindow

• 0x4332f0 SetWindowTextW

• 0x4332f4 KillTimer

• 0x4332f8 LoadStringW

• 0x4332fc GetClientRect

• 0x433300 GetWindowRect

• 0x433304 ScreenToClient

• 0x433308 MoveWindow

• 0x43330c DialogBoxParamW

• 0x433310 EndDialog

• 0x433314 SetTimer

• 0x433318 IsWindow

• 0x43331c GetDC

• 0x433320 LoadCursorW

• 0x433324 RegisterClassExW

• 0x433328 CreateWindowExW

• 0x43332c UpdateWindow

• 0x433330 DefWindowProcW

• 0x433334 BeginPaint

• 0x433338 EndPaint

• 0x43333c FindWindowW

• 0x433340 EnumDisplaySettingsExW

• 0x433344 GetSystemMetrics

• 0x433348 ChangeDisplaySettingsW

• 0x43334c IsWindowEnabled

• 0x433350 ShowWindow

• 0x433354 SendMessageW

• 0x433358 GetDlgItem

• 0x43335c EnableWindow

• 0x433360 SetDlgItemTextW

• 0x433364 CheckDlgButton

• 0x433368 SetFocus

• 0x43336c GetWindowLongW

• 0x433370 GetParent

• 0x433374 EnumDisplaySettingsW

Library GDI32.dll:

• 0x433080 CreateFontW

• 0x433084 GetDeviceCaps

• 0x433088 GetObjectW

• 0x43308c CreateBrushIndirect

• 0x433090 PatBlt

• 0x433094 GetPixel

• 0x433098 CreateCompatibleDC

• 0x43309c CreateBitmap

• 0x4330a0 CreateCompatibleBitmap

• 0x4330a4 SetStretchBltMode

• 0x4330a8 StretchBlt

• 0x4330ac BitBlt

• 0x4330b0 SetBkColor

• 0x4330b4 GetStockObject

• 0x4330b8 CreateFontIndirectW

• 0x4330bc SetBkMode

• 0x4330c0 SelectObject

• 0x4330c4 SetTextColor

• 0x4330c8 GetTextExtentPoint32W

• 0x4330cc TextOutW

• 0x4330d0 DeleteObject

• 0x4330d4 CreateDCW

• 0x4330d8 DeleteDC

Library ADVAPI32.dll:

• 0x433000 AddAccessAllowedAce

• 0x433004 RegQueryValueExW

• 0x433008 RegOpenKeyExW

• 0x43300c RegDeleteValueW

• 0x433010 RegFlushKey

• 0x433014 RegEnumKeyExW

• 0x433018 RegLoadKeyW

• 0x43301c RegUnLoadKeyW

• 0x433020 RegDeleteKeyW

• 0x433024 ImpersonateSelf

• 0x433028 OpenThreadToken

• 0x43302c AllocateAndInitializeSid

• 0x433030 InitializeSecurityDescriptor

• 0x433034 GetLengthSid

• 0x433038 InitializeAcl

• 0x43303c RegCloseKey

• 0x433040 SetSecurityDescriptorDacl

• 0x433044 SetSecurityDescriptorGroup

• 0x433048 SetSecurityDescriptorOwner

• 0x43304c IsValidSecurityDescriptor

• 0x433050 AccessCheck

• 0x433054 RevertToSelf

• 0x433058 FreeSid

• 0x43305c RegCreateKeyExW

• 0x433060 OpenProcessToken

• 0x433064 LookupPrivilegeValueW

• 0x433068 AdjustTokenPrivileges

• 0x43306c RegSetValueExW

Library SHELL32.dll:

• 0x433298 ShellExecuteW

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	55371	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.