2.2
中危
1 个模型检测该样本为恶意！
重新分析
更多

1d9b24f2b68b1363b5ea4a6a075fddcf3ea652507fb318b03727c1fe69b3f89c

4f9de8a6cf8abb763b9d080ed204fc3a.exe

分析耗时

29s

最近分析

文件大小

616.2KB
静态报毒 动态报毒 MS04
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20200414 6.0.6.653
Alibaba 20190527 0.3.0.5
Avast 20200413 18.4.3895.0
Baidu 20190318 1.0.0.2
Kingsoft 20200414 2013.8.14.323
Tencent 20200414 1.0.0.1
CrowdStrike 20190702 1.0
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1620755236.647625
IsDebuggerPresent
failed 0 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
Creates executable files on the filesystem (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\edge.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\n2ngui.exe
Drops an executable to the user AppData folder (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\edge.exe
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\n2ngui.exe
File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)
CMC Exploit.Win32.MS04-028!O
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2009-02-03 15:21:07

Imports

Library USER32.dll:
• 0x41c17c GetDlgItem
• 0x41c180 IsDlgButtonChecked
• 0x41c184 PostMessageA
• 0x41c188 MessageBoxW
• 0x41c18c KillTimer
• 0x41c190 SetTimer
• 0x41c194 DialogBoxParamW
• 0x41c198 DialogBoxParamA
• 0x41c19c SetWindowLongA
• 0x41c1a0 GetWindowLongA
• 0x41c1a8 GetWindowTextW
• 0x41c1b0 GetWindowTextA
• 0x41c1b4 SetWindowTextW
• 0x41c1b8 SetWindowTextA
• 0x41c1bc SendMessageW
• 0x41c1c0 SendMessageA
• 0x41c1c4 LoadStringW
• 0x41c1c8 LoadStringA
• 0x41c1cc CharUpperW
• 0x41c1d0 CharUpperA
• 0x41c1d4 EndDialog
Library OLEAUT32.dll:
• 0x41c158 SysAllocString
• 0x41c15c VariantClear
• 0x41c160 SysFreeString
Library SHELL32.dll:
• 0x41c16c SHGetMalloc
• 0x41c170 SHGetFileInfoA
• 0x41c174 SHBrowseForFolderA
Library ole32.dll:
• 0x41c1dc CoUninitialize
• 0x41c1e0 CoInitialize
Library MSVCRT.dll:
• 0x41c0ec _controlfp
• 0x41c0f0 __set_app_type
• 0x41c0f4 __p__fmode
• 0x41c0f8 __p__commode
• 0x41c0fc _adjust_fdiv
• 0x41c100 __setusermatherr
• 0x41c104 _initterm
• 0x41c108 __getmainargs
• 0x41c10c _acmdln
• 0x41c110 exit
• 0x41c114 _XcptFilter
• 0x41c118 _exit
• 0x41c11c _onexit
• 0x41c120 __dllonexit
• 0x41c128 _except_handler3
• 0x41c12c _beginthreadex
• 0x41c130 memset
• 0x41c134 memcpy
• 0x41c138 free
• 0x41c13c malloc
• 0x41c140 memmove
• 0x41c144 _CxxThrowException
• 0x41c148 _purecall
• 0x41c14c memcmp
• 0x41c150 __CxxFrameHandler
Library KERNEL32.dll:
• 0x41c000 WideCharToMultiByte
• 0x41c004 GetStartupInfoA
• 0x41c008 GetModuleHandleA
• 0x41c010 ResetEvent
• 0x41c014 SetEvent
• 0x41c018 CreateEventA
• 0x41c01c WaitForSingleObject
• 0x41c020 VirtualFree
• 0x41c024 VirtualAlloc
• 0x41c028 Sleep
• 0x41c03c GetStdHandle
• 0x41c040 GetModuleHandleW
• 0x41c044 GetProcAddress
• 0x41c04c SetEndOfFile
• 0x41c050 WriteFile
• 0x41c054 ReadFile
• 0x41c058 SetFilePointer
• 0x41c05c GetFileSize
• 0x41c060 CreateFileA
• 0x41c064 FindFirstFileW
• 0x41c068 FindFirstFileA
• 0x41c06c FindClose
• 0x41c078 GetFullPathNameW
• 0x41c07c GetFullPathNameA
• 0x41c080 lstrlenA
• 0x41c084 DeleteFileW
• 0x41c088 DeleteFileA
• 0x41c08c CreateDirectoryW
• 0x41c090 CreateDirectoryA
• 0x41c094 MoveFileW
• 0x41c098 RemoveDirectoryW
• 0x41c09c SetFileAttributesW
• 0x41c0a0 MoveFileA
• 0x41c0a4 RemoveDirectoryA
• 0x41c0a8 SetFileAttributesA
• 0x41c0ac SetLastError
• 0x41c0b0 CreateFileW
• 0x41c0b4 SetFileTime
• 0x41c0b8 CloseHandle
• 0x41c0bc FormatMessageW
• 0x41c0c0 FormatMessageA
• 0x41c0c4 LocalFree
• 0x41c0c8 GetModuleFileNameW
• 0x41c0cc GetModuleFileNameA
• 0x41c0d0 AreFileApisANSI
• 0x41c0d4 GetCommandLineW
• 0x41c0dc GetVersionExA
• 0x41c0e0 MultiByteToWideChar
• 0x41c0e4 GetLastError

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 57756 114.114.114.114 53
192.168.56.101 62318 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51968 239.255.255.250 1900
192.168.56.101 58368 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.