SmartHawk

3.2

中危

46 个模型检测该样本为恶意！

重新分析

下载样本

dd459a68bc0a228ecbccaf4d1891492e5d13791bf73dfb5febb136bfa46df367

5cef3ecc8a0aee3cffc02c4a71486d06.exe

分析耗时

20s

最近分析

文件大小

7.0KB

静态报毒动态报毒 AGEN AI SCORE=86 AM0@AQFTWEC CLASSIC CONFIDENCE HACKTOOL HMEIYX MALWARE@#2OEFF6QDAK3E5 METERPRETER P1LBGK R + MAL ROZENA SCORE SSQQ STARTER SWRORT TROJANX TSCOPE UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	RDN/Generic.dx	20201023	6.0.6.653
Alibaba	VirTool:MSIL/Meterpreter.3af6177a	20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast	Win32:TrojanX-gen [Trj]	20201023	18.4.3895.0
Tencent		20201023	1.0.0.1
Kingsoft		20201023	2013.8.14.323
CrowdStrike	win/malicious_confidence_80% (W)	20190702	1.0

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619522972.376 GetComputerNameA	computer_name: OSKAR-PC	success	1	0
1619522972.376 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (4 个事件)

Time & API	Arguments	Status	Return	Repeated
1619522971.282 IsDebuggerPresent		failed	0	0
1619522971.282 IsDebuggerPresent		failed	0	0
1619522972.329 IsDebuggerPresent		failed	0	0
1619522972.329 IsDebuggerPresent		failed	0	0

This executable has a PDB path (1 个事件)

pdb_path

c:\users\dbapp\documents\visual studio 2015\Projects\ConsoleApplication1\ConsoleApplication1\obj\Debug\ConsoleApplication1.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619522971.391 GlobalMemoryStatusEx		success	1	0

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619522972.313 __exception__	stacktrace: registers.esp: 81393676 registers.edi: 0 registers.eax: 1983198135 registers.ebp: 11665418 registers.edx: 11665408 registers.ebx: 0 registers.esi: 1768843639 registers.ecx: 4294967295 exception.instruction_r: 6e 65 74 00 41 56 49 89 e6 4c 89 f1 41 ba 4c 77 exception.instruction: outsb dx, byte ptr [esi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0xb200db	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (18 个事件)

Time & API	Arguments	Status
1619522970.532 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00430000	success
1619522970.532 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x004a0000	success
1619522970.969 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 1966080 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x020b0000	success
1619522970.969 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02250000	success
1619522971.079 NtProtectVirtualMemory	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619522971.282 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00430000	success
1619522971.282 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00440000	success
1619522971.282 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002ca000	success
1619522971.298 NtProtectVirtualMemory	process_identifier: 2228 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619522971.298 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002c2000	success
1619522971.798 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002d2000	success
1619522972.001 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002f5000	success
1619522972.001 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002fb000	success
1619522972.001 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002f7000	success
1619522972.141 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002d3000	success
1619522972.188 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x002dc000	success
1619522972.266 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b10000	success
1619522972.298 NtAllocateVirtualMemory	process_identifier: 2228 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00b20000	success

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 个事件)

MicroWorld-eScan	Generic.Exploit.Shellcode.2.C6256762
FireEye	Generic.mg.5cef3ecc8a0aee3c
McAfee	RDN/Generic.dx
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Trojan ( 0055d3f11 )
Alibaba	VirTool:MSIL/Meterpreter.3af6177a
K7GW	Trojan ( 0055d3f11 )
Cybereason	malicious.c8a0ae
Arcabit	Generic.Exploit.Shellcode.2.C6256762
BitDefenderTheta	Gen:NN.ZemsilF.34570.am0@aqFTwEc
Symantec	Meterpreter
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 85)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Generic.Exploit.Shellcode.2.C6256762
NANO-Antivirus	Trojan.Win32.Starter.hmeiyx
Avast	Win32:TrojanX-gen [Trj]
Ad-Aware	Generic.Exploit.Shellcode.2.C6256762
Emsisoft	Generic.Exploit.Shellcode.2.C6256762 (B)
Comodo	Malware@#2oeff6qdak3e5
F-Secure	Heuristic.HEUR/AGEN.1110055
DrWeb	Trojan.Starter.7246
VIPRE	Trojan.Win32.Generic!BT
Invincea	Mal/Generic-R + Mal/Swrort-W
McAfee-GW-Edition	RDN/Generic.dx
Sophos	Mal/Swrort-W
Ikarus	Trojan.MSIL.Rozena
Avira	HEUR/AGEN.1110055
Antiy-AVL	HackTool[VirTool]/MSIL.Meterpreter
Microsoft	VirTool:MSIL/Meterpreter.G!MTB
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Generic.Exploit.Shellcode.2.C6256762
AhnLab-V3	Trojan/Win32.RL_Generic.C3510508
VBA32	TScope.Trojan.MSIL
ALYac	Generic.Exploit.Shellcode.2.C6256762
MAX	malware (ai score=86)
ESET-NOD32	a variant of MSIL/Rozena.W
Rising	Trojan.Agent!1.C856 (CLASSIC)
Yandex	Trojan.Rozena!P1LBGk/ssqQ
Fortinet	MSIL/Rozena.W!tr
AVG	Win32:TrojanX-gen [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_80% (W)
Qihoo-360	Win32/Trojan.fc8

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-06-21 16:10:40

Imports

Library mscoree.dll:

• 0x402000 _CorExeMain

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702
192.168.56.101	58370	239.255.255.250	3702
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.