SmartHawk

2.8

中危

该样本未表现出任何异常！

重新分析

下载样本

3d5ccf2295d249dcdc8309b2471ba26943edd9945ececd27929335cccf65049b

5d2216c22cbd6af8d98e633c6d27010a.exe

分析耗时

40s

Time & API	Arguments	Status	Return	Repeated
1620794160.967 NtAllocateVirtualMemory	process_identifier: 1880 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003d0000	success	0	0

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x48e168 DeleteCriticalSection

• 0x48e16c LeaveCriticalSection

• 0x48e170 EnterCriticalSection

• 0x48e174 InitializeCriticalSection

• 0x48e178 VirtualFree

• 0x48e17c VirtualAlloc

• 0x48e180 LocalFree

• 0x48e184 LocalAlloc

• 0x48e188 GetVersion

• 0x48e18c GetCurrentThreadId

• 0x48e190 InterlockedDecrement

• 0x48e194 InterlockedIncrement

• 0x48e198 VirtualQuery

• 0x48e19c WideCharToMultiByte

• 0x48e1a0 MultiByteToWideChar

• 0x48e1a4 lstrlenA

• 0x48e1a8 lstrcpynA

• 0x48e1ac LoadLibraryExA

• 0x48e1b0 GetThreadLocale

• 0x48e1b4 GetStartupInfoA

• 0x48e1b8 GetProcAddress

• 0x48e1bc GetModuleHandleA

• 0x48e1c0 GetModuleFileNameA

• 0x48e1c4 GetLocaleInfoA

• 0x48e1c8 GetCommandLineA

• 0x48e1cc FreeLibrary

• 0x48e1d0 FindFirstFileA

• 0x48e1d4 FindClose

• 0x48e1d8 ExitProcess

• 0x48e1dc ExitThread

• 0x48e1e0 CreateThread

• 0x48e1e4 WriteFile

• 0x48e1e8 UnhandledExceptionFilter

• 0x48e1ec RtlUnwind

• 0x48e1f0 RaiseException

• 0x48e1f4 GetStdHandle

Library user32.dll:

• 0x48e1fc GetKeyboardType

• 0x48e200 LoadStringA

• 0x48e204 MessageBoxA

• 0x48e208 CharNextA

Library advapi32.dll:

• 0x48e210 RegQueryValueExA

• 0x48e214 RegOpenKeyExA

• 0x48e218 RegCloseKey

Library oleaut32.dll:

• 0x48e220 SysFreeString

• 0x48e224 SysReAllocStringLen

• 0x48e228 SysAllocStringLen

Library kernel32.dll:

• 0x48e230 TlsSetValue

• 0x48e234 TlsGetValue

• 0x48e238 LocalAlloc

• 0x48e23c GetModuleHandleA

Library advapi32.dll:

• 0x48e244 RegQueryValueExA

• 0x48e248 RegOpenKeyExA

• 0x48e24c RegCloseKey

Library kernel32.dll:

• 0x48e254 lstrcpyA

• 0x48e258 WriteFile

• 0x48e25c WaitForSingleObjectEx

• 0x48e260 WaitForSingleObject

• 0x48e264 VirtualQuery

• 0x48e268 VirtualProtectEx

• 0x48e26c VirtualProtect

• 0x48e270 VirtualAlloc

• 0x48e274 SuspendThread

• 0x48e278 Sleep

• 0x48e27c SizeofResource

• 0x48e280 SetThreadLocale

• 0x48e284 SetFilePointer

• 0x48e288 SetEvent

• 0x48e28c SetErrorMode

• 0x48e290 SetEndOfFile

• 0x48e294 ResumeThread

• 0x48e298 ResetEvent

• 0x48e29c ReadFile

• 0x48e2a0 MultiByteToWideChar

• 0x48e2a4 MulDiv

• 0x48e2a8 LockResource

• 0x48e2ac LoadResource

• 0x48e2b0 LoadLibraryA

• 0x48e2b4 LeaveCriticalSection

• 0x48e2b8 InitializeCriticalSection

• 0x48e2bc GlobalUnlock

• 0x48e2c0 GlobalReAlloc

• 0x48e2c4 GlobalHandle

• 0x48e2c8 GlobalLock

• 0x48e2cc GlobalFree

• 0x48e2d0 GlobalFindAtomA

• 0x48e2d4 GlobalDeleteAtom

• 0x48e2d8 GlobalAlloc

• 0x48e2dc GlobalAddAtomA

• 0x48e2e0 GetVersionExA

• 0x48e2e4 GetVersion

• 0x48e2e8 GetTickCount

• 0x48e2ec GetThreadLocale

• 0x48e2f0 GetTempPathA

• 0x48e2f4 GetSystemTimeAsFileTime

• 0x48e2f8 GetSystemTime

• 0x48e2fc GetSystemInfo

• 0x48e300 GetStringTypeExA

• 0x48e304 GetStdHandle

• 0x48e308 GetProcAddress

• 0x48e30c GetModuleHandleA

• 0x48e310 GetModuleFileNameA

• 0x48e314 GetLocaleInfoA

• 0x48e318 GetLocalTime

• 0x48e31c GetLastError

• 0x48e320 GetFullPathNameA

• 0x48e324 GetFileSize

• 0x48e328 GetExitCodeThread

• 0x48e32c GetDiskFreeSpaceA

• 0x48e330 GetDateFormatA

• 0x48e334 GetCurrentThreadId

• 0x48e338 GetCurrentProcessId

• 0x48e33c GetCurrentProcess

• 0x48e340 GetCPInfo

• 0x48e344 GetACP

• 0x48e348 FreeResource

• 0x48e34c InterlockedIncrement

• 0x48e350 InterlockedExchange

• 0x48e354 InterlockedDecrement

• 0x48e358 FreeLibrary

• 0x48e35c FormatMessageA

• 0x48e360 FindResourceA

• 0x48e364 FileTimeToSystemTime

• 0x48e368 ExitProcess

• 0x48e36c EnumCalendarInfoA

• 0x48e370 EnterCriticalSection

• 0x48e374 DeleteCriticalSection

• 0x48e378 CreateThread

• 0x48e37c CreateFileA

• 0x48e380 CreateEventA

• 0x48e384 CompareStringA

• 0x48e388 CloseHandle

Library version.dll:

• 0x48e390 VerQueryValueA

• 0x48e394 GetFileVersionInfoSizeA

• 0x48e398 GetFileVersionInfoA

Library gdi32.dll:

• 0x48e3a0 UnrealizeObject

• 0x48e3a4 StretchBlt

• 0x48e3a8 SetWindowOrgEx

• 0x48e3ac SetViewportOrgEx

• 0x48e3b0 SetTextColor

• 0x48e3b4 SetStretchBltMode

• 0x48e3b8 SetROP2

• 0x48e3bc SetPixel

• 0x48e3c0 SetDIBColorTable

• 0x48e3c4 SetBrushOrgEx

• 0x48e3c8 SetBkMode

• 0x48e3cc SetBkColor

• 0x48e3d0 SelectPalette

• 0x48e3d4 SelectObject

• 0x48e3d8 SaveDC

• 0x48e3dc RestoreDC

• 0x48e3e0 Rectangle

• 0x48e3e4 RectVisible

• 0x48e3e8 RealizePalette

• 0x48e3ec PtVisible

• 0x48e3f0 PatBlt

• 0x48e3f4 MoveToEx

• 0x48e3f8 MaskBlt

• 0x48e3fc LineTo

• 0x48e400 IntersectClipRect

• 0x48e404 GetWindowOrgEx

• 0x48e408 GetTextMetricsA

• 0x48e40c GetTextExtentPoint32A

• 0x48e410 GetSystemPaletteEntries

• 0x48e414 GetStockObject

• 0x48e418 GetPixel

• 0x48e41c GetPaletteEntries

• 0x48e420 GetObjectA

• 0x48e424 GetDeviceCaps

• 0x48e428 GetDIBits

• 0x48e42c GetDIBColorTable

• 0x48e430 GetDCOrgEx

• 0x48e434 GetCurrentPositionEx

• 0x48e438 GetClipBox

• 0x48e43c GetBrushOrgEx

• 0x48e440 GetBitmapBits

• 0x48e444 ExtTextOutA

• 0x48e448 ExcludeClipRect

• 0x48e44c DeleteObject

• 0x48e450 DeleteDC

• 0x48e454 CreateSolidBrush

• 0x48e458 CreatePenIndirect

• 0x48e45c CreatePen

• 0x48e460 CreatePalette

• 0x48e464 CreateHalftonePalette

• 0x48e468 CreateFontIndirectA

• 0x48e46c CreateDIBitmap

• 0x48e470 CreateDIBSection

• 0x48e474 CreateCompatibleDC

• 0x48e478 CreateCompatibleBitmap

• 0x48e47c CreateBrushIndirect

• 0x48e480 CreateBitmap

• 0x48e484 BitBlt

Library user32.dll:

• 0x48e48c CreateWindowExA

• 0x48e490 WindowFromPoint

• 0x48e494 WinHelpA

• 0x48e498 WaitMessage

• 0x48e49c ValidateRect

• 0x48e4a0 UpdateWindow

• 0x48e4a4 UnregisterClassA

• 0x48e4a8 UnhookWindowsHookEx

• 0x48e4ac TranslateMessage

• 0x48e4b0 TranslateMDISysAccel

• 0x48e4b4 TrackPopupMenu

• 0x48e4b8 SystemParametersInfoA

• 0x48e4bc ShowWindow

• 0x48e4c0 ShowScrollBar

• 0x48e4c4 ShowOwnedPopups

• 0x48e4c8 ShowCursor

• 0x48e4cc SetWindowsHookExA

• 0x48e4d0 SetWindowTextA

• 0x48e4d4 SetWindowPos

• 0x48e4d8 SetWindowPlacement

• 0x48e4dc SetWindowLongA

• 0x48e4e0 SetTimer

• 0x48e4e4 SetScrollRange

• 0x48e4e8 SetScrollPos

• 0x48e4ec SetScrollInfo

• 0x48e4f0 SetRect

• 0x48e4f4 SetPropA

• 0x48e4f8 SetParent

• 0x48e4fc SetMenuItemInfoA

• 0x48e500 SetMenu

• 0x48e504 SetForegroundWindow

• 0x48e508 SetFocus

• 0x48e50c SetCursor

• 0x48e510 SetClassLongA

• 0x48e514 SetCapture

• 0x48e518 SetActiveWindow

• 0x48e51c SendMessageA

• 0x48e520 ScrollWindow

• 0x48e524 ScreenToClient

• 0x48e528 RemovePropA

• 0x48e52c RemoveMenu

• 0x48e530 ReleaseDC

• 0x48e534 ReleaseCapture

• 0x48e538 RegisterWindowMessageA

• 0x48e53c RegisterClipboardFormatA

• 0x48e540 RegisterClassA

• 0x48e544 RedrawWindow

• 0x48e548 PtInRect

• 0x48e54c PostQuitMessage

• 0x48e550 PostMessageA

• 0x48e554 PeekMessageA

• 0x48e558 OffsetRect

• 0x48e55c OemToCharA

• 0x48e560 MsgWaitForMultipleObjects

• 0x48e564 MessageBoxA

• 0x48e568 MapWindowPoints

• 0x48e56c MapVirtualKeyA

• 0x48e570 LoadStringA

• 0x48e574 LoadKeyboardLayoutA

• 0x48e578 LoadIconA

• 0x48e57c LoadCursorA

• 0x48e580 LoadBitmapA

• 0x48e584 KillTimer

• 0x48e588 IsZoomed

• 0x48e58c IsWindowVisible

• 0x48e590 IsWindowEnabled

• 0x48e594 IsWindow

• 0x48e598 IsRectEmpty

• 0x48e59c IsIconic

• 0x48e5a0 IsDialogMessageA

• 0x48e5a4 IsChild

• 0x48e5a8 InvalidateRect

• 0x48e5ac IntersectRect

• 0x48e5b0 InsertMenuItemA

• 0x48e5b4 InsertMenuA

• 0x48e5b8 InflateRect

• 0x48e5bc GetWindowThreadProcessId

• 0x48e5c0 GetWindowTextA

• 0x48e5c4 GetWindowRect

• 0x48e5c8 GetWindowPlacement

• 0x48e5cc GetWindowLongA

• 0x48e5d0 GetWindowDC

• 0x48e5d4 GetTopWindow

• 0x48e5d8 GetSystemMetrics

• 0x48e5dc GetSystemMenu

• 0x48e5e0 GetSysColorBrush

• 0x48e5e4 GetSysColor

• 0x48e5e8 GetSubMenu

• 0x48e5ec GetScrollRange

• 0x48e5f0 GetScrollPos

• 0x48e5f4 GetScrollInfo

• 0x48e5f8 GetPropA

• 0x48e5fc GetParent

• 0x48e600 GetWindow

• 0x48e604 GetMenuStringA

• 0x48e608 GetMenuState

• 0x48e60c GetMenuItemInfoA

• 0x48e610 GetMenuItemID

• 0x48e614 GetMenuItemCount

• 0x48e618 GetMenu

• 0x48e61c GetLastActivePopup

• 0x48e620 GetKeyboardState

• 0x48e624 GetKeyboardLayoutList

• 0x48e628 GetKeyboardLayout

• 0x48e62c GetKeyState

• 0x48e630 GetKeyNameTextA

• 0x48e634 GetIconInfo

• 0x48e638 GetForegroundWindow

• 0x48e63c GetFocus

• 0x48e640 GetDlgItem

• 0x48e644 GetDesktopWindow

• 0x48e648 GetDCEx

• 0x48e64c GetDC

• 0x48e650 GetCursorPos

• 0x48e654 GetCursor

• 0x48e658 GetClientRect

• 0x48e65c GetClassNameA

• 0x48e660 GetClassInfoA

• 0x48e664 GetCapture

• 0x48e668 GetActiveWindow

• 0x48e66c FrameRect

• 0x48e670 FindWindowA

• 0x48e674 FillRect

• 0x48e678 EqualRect

• 0x48e67c EnumWindows

• 0x48e680 EnumThreadWindows

• 0x48e684 EndPaint

• 0x48e688 EnableWindow

• 0x48e68c EnableScrollBar

• 0x48e690 EnableMenuItem

• 0x48e694 DrawTextA

• 0x48e698 DrawMenuBar

• 0x48e69c DrawIconEx

• 0x48e6a0 DrawIcon

• 0x48e6a4 DrawFrameControl

• 0x48e6a8 DrawFocusRect

• 0x48e6ac DrawEdge

• 0x48e6b0 DispatchMessageA

• 0x48e6b4 DestroyWindow

• 0x48e6b8 DestroyMenu

• 0x48e6bc DestroyIcon

• 0x48e6c0 DestroyCursor

• 0x48e6c4 DeleteMenu

• 0x48e6c8 DefWindowProcA

• 0x48e6cc DefMDIChildProcA

• 0x48e6d0 DefFrameProcA

• 0x48e6d4 CreatePopupMenu

• 0x48e6d8 CreateMenu

• 0x48e6dc CreateIcon

• 0x48e6e0 ClientToScreen

• 0x48e6e4 CheckMenuItem

• 0x48e6e8 CallWindowProcA

• 0x48e6ec CallNextHookEx

• 0x48e6f0 BeginPaint

• 0x48e6f4 CharNextA

• 0x48e6f8 CharLowerA

• 0x48e6fc CharToOemA

• 0x48e700 AdjustWindowRectEx

• 0x48e704 ActivateKeyboardLayout

Library kernel32.dll:

• 0x48e70c Sleep

Library oleaut32.dll:

• 0x48e714 SafeArrayPtrOfIndex

• 0x48e718 SafeArrayGetUBound

• 0x48e71c SafeArrayGetLBound

• 0x48e720 SafeArrayCreate

• 0x48e724 VariantChangeType

• 0x48e728 VariantCopy

• 0x48e72c VariantClear

• 0x48e730 VariantInit

Library ole32.dll:

• 0x48e738 CoCreateInstance

• 0x48e73c CoUninitialize

• 0x48e740 CoInitialize

Library oleaut32.dll:

• 0x48e748 CreateErrorInfo

• 0x48e74c GetErrorInfo

• 0x48e750 SetErrorInfo

• 0x48e754 SysFreeString

Library comctl32.dll:

• 0x48e75c ImageList_SetIconSize

• 0x48e760 ImageList_GetIconSize

• 0x48e764 ImageList_Write

• 0x48e768 ImageList_Read

• 0x48e76c ImageList_GetDragImage

• 0x48e770 ImageList_DragShowNolock

• 0x48e774 ImageList_SetDragCursorImage

• 0x48e778 ImageList_DragMove

• 0x48e77c ImageList_DragLeave

• 0x48e780 ImageList_DragEnter

• 0x48e784 ImageList_EndDrag

• 0x48e788 ImageList_BeginDrag

• 0x48e78c ImageList_Remove

• 0x48e790 ImageList_DrawEx

• 0x48e794 ImageList_Draw

• 0x48e798 ImageList_GetBkColor

• 0x48e79c ImageList_SetBkColor

• 0x48e7a0 ImageList_ReplaceIcon

• 0x48e7a4 ImageList_Add

• 0x48e7a8 ImageList_GetImageCount

• 0x48e7ac ImageList_Destroy

• 0x48e7b0 ImageList_Create

• 0x48e7b4 InitCommonControls

Library comdlg32.dll:

• 0x48e7bc GetOpenFileNameA

Library kernel32.dll:

• 0x48e7c4 AddVectoredExceptionHandler

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	216.58.200.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51379	239.255.255.250	3702
192.168.56.101	55371	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.

section	CODE
section	DATA
section	BSS