SmartHawk

4.8

中危

该样本未表现出任何异常！

重新分析

下载样本

4ae4e497bbdbafcf352058a36becacbc9fd709b31cf5444353090c3b88ca894d

5a22c8f30fcf6d8c22e68b8373c0306f.exe

分析耗时

78s

最近分析

文件大小

160.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513325.467008 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (4 个事件)

Time & API	Arguments	Status	Return
1619513309.733008 CryptGenKey	crypto_handle: 0x00626f90 algorithm_identifier: 0x0000660e () provider_handle: 0x00626160 flags: 1 key: f=ºm×)Í¢¤`põ}È	success	1
1619513325.483008 CryptExportKey	crypto_handle: 0x00626f90 crypto_export_handle: 0x00626238 buffer: f¤êÓò4Ùj'hK\þr< ¹Z²ãp$ÙBhh -MÝìÃÅÙ$xdö_zf#]\|D·ãpOÙÛö¡xq×ªVäJÈDâ`}X·¾µ*aA blob_type: 1 flags: 64	success	1
1619513361.826008 CryptExportKey	crypto_handle: 0x00626f90 crypto_export_handle: 0x00626238 buffer: f¤Cä.ÞýÁx9É½íà7r¨xu¬t¤v6/3PÜ¦£DÆV¨Ëþóÿ¥bàp¡8rñß9K¬£¨ËA$Mnf5ìMRÌÅï8{P÷3 blob_type: 1 flags: 64	success	1
1619513367.639008 CryptExportKey	crypto_handle: 0x00626f90 crypto_export_handle: 0x00626238 buffer: f¤SÛjýO©o#<;ò,ìà"Ð8¬~V¹C¾ãVL£Tþr8yàj»r0¢&oã<ÿ2t~U¨rù>_PG«¿¾(±§¶\|ÛMÑü(Ë9èxS blob_type: 1 flags: 64	success	1

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513309.108008 NtAllocateVirtualMemory	process_identifier: 2104 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x003b0000	success	0	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513326.092008 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

Expresses interest in specific running processes (1 个事件)

process

5a22c8f30fcf6d8c22e68b8373c0306f.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619513325.701008 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (4 个事件)

host	172.217.24.14
host	181.30.61.163
host	209.126.6.222
host	5.153.250.14

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619513328.670008 RegSetValueExA	key_handle: 0x0000037c value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619513328.670008 RegSetValueExA	key_handle: 0x0000037c value: àlÆS;× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619513328.670008 RegSetValueExA	key_handle: 0x0000037c value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619513328.670008 RegSetValueExW	key_handle: 0x0000037c value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619513328.670008 RegSetValueExA	key_handle: 0x00000394 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619513328.670008 RegSetValueExA	key_handle: 0x00000394 value: àlÆS;× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619513328.670008 RegSetValueExA	key_handle: 0x00000394 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619513328.701008 RegSetValueExW	key_handle: 0x00000378 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	209.126.6.222:8080
dead_host	192.168.56.101:49177
dead_host	181.30.61.163:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-08-21 23:25:46

Imports

Library WINMM.dll:

• 0x40b140 waveOutGetVolume

• 0x40b144 waveInReset

• 0x40b148 waveInUnprepareHeader

• 0x40b14c waveInClose

• 0x40b150 waveInOpen

• 0x40b154 waveInPrepareHeader

• 0x40b158 waveInAddBuffer

• 0x40b15c waveInStart

• 0x40b160 waveOutSetVolume

• 0x40b164 mixerOpen

• 0x40b168 mixerGetLineInfoA

• 0x40b16c mixerClose

• 0x40b170 mixerGetLineControlsA

• 0x40b174 mixerGetControlDetailsA

• 0x40b178 mixerSetControlDetails

• 0x40b17c mciGetErrorStringA

Library COMCTL32.dll:

• 0x40b000

Library KERNEL32.dll:

• 0x40b024 QueryPerformanceCounter

• 0x40b028 SetStdHandle

• 0x40b02c GetOEMCP

• 0x40b030 GetACP

• 0x40b034 LoadLibraryA

• 0x40b038 IsBadCodePtr

• 0x40b03c IsBadReadPtr

• 0x40b040 InterlockedExchange

• 0x40b044 GetTickCount

• 0x40b048 GetCurrentThreadId

• 0x40b04c OutputDebugStringA

• 0x40b050 VirtualAlloc

• 0x40b054 GetCurrentProcessId

• 0x40b058 GetModuleHandleA

• 0x40b05c ExitProcess

• 0x40b060 GetCPInfo

• 0x40b064 GetLocaleInfoA

• 0x40b068 SetFilePointer

• 0x40b06c SetUnhandledExceptionFilter

• 0x40b070 HeapSize

• 0x40b074 GetFileType

• 0x40b078 SetHandleCount

• 0x40b07c GetEnvironmentStringsW

• 0x40b080 FreeEnvironmentStringsW

• 0x40b084 GetEnvironmentStrings

• 0x40b088 FreeEnvironmentStringsA

• 0x40b08c UnhandledExceptionFilter

• 0x40b090 GetSystemTimeAsFileTime

• 0x40b094 GetStringTypeA

• 0x40b098 GetStringTypeW

• 0x40b09c FlushFileBuffers

• 0x40b0a0 VirtualFree

• 0x40b0a4 RaiseException

• 0x40b0a8 HeapAlloc

• 0x40b0ac RtlUnwind

• 0x40b0b0 GetStartupInfoA

• 0x40b0b4 GetCommandLineA

• 0x40b0b8 GetVersionExA

• 0x40b0bc CloseHandle

• 0x40b0c0 HeapFree

• 0x40b0c4 GetProcAddress

• 0x40b0c8 VirtualProtect

• 0x40b0cc GetSystemInfo

• 0x40b0d0 VirtualQuery

• 0x40b0d4 MultiByteToWideChar

• 0x40b0d8 LCMapStringA

• 0x40b0dc WideCharToMultiByte

• 0x40b0e0 GetLastError

• 0x40b0e4 LCMapStringW

• 0x40b0e8 HeapDestroy

• 0x40b0ec HeapCreate

• 0x40b0f0 HeapReAlloc

• 0x40b0f4 IsBadWritePtr

• 0x40b0f8 TerminateProcess

• 0x40b0fc GetCurrentProcess

• 0x40b100 WriteFile

• 0x40b104 GetStdHandle

• 0x40b108 GetModuleFileNameA

Library USER32.dll:

• 0x40b110 LoadIconA

• 0x40b114 DialogBoxParamA

• 0x40b118 SendMessageA

• 0x40b11c EndDialog

• 0x40b120 GetDlgItem

• 0x40b124 GetClientRect

• 0x40b128 GetDC

• 0x40b12c ReleaseDC

• 0x40b130 GetDlgCtrlID

• 0x40b134 ShowWindow

• 0x40b138 MessageBoxA

Library GDI32.dll:

• 0x40b008 DeleteDC

• 0x40b00c CreateCompatibleDC

• 0x40b010 CreateCompatibleBitmap

• 0x40b014 CreateSolidBrush

• 0x40b018 DeleteObject

• 0x40b01c SelectObject

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	53658	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	60124	239.255.255.250	3702
192.168.56.101	62194	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.