SmartHawk

4.6

中危

10 个模型检测该样本为恶意！

重新分析

下载样本

70426f9a93027b4e6d363dff7af90eef17e29a8a962117740813a7ba8e29f57f

5dab92f76c835b7d53075dfbae018f3a.exe

分析耗时

96s

最近分析

文件大小

1.2MB

静态报毒动态报毒 100% AMVAL CONFIDENCE HIGH CONFIDENCE SCORE UNSAFE

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee		20200626	6.0.6.653
Alibaba		20190527	0.3.0.5
CrowdStrike	win/malicious_confidence_60% (W)	20190702	1.0
Baidu		20190318	1.0.0.2
Avast		20200626	18.4.3895.0
Tencent		20200626	1.0.0.1
Kingsoft		20200626	2013.8.14.323

Queries for the computername (3 个事件)

Time & API	Arguments	Status	Return
1620783405.501249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620783406.454249 GetComputerNameW	computer_name: OSKAR-PC	success	1
1620783406.486249 GetComputerNameW	computer_name: OSKAR-PC	success	1

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620783405.048249 IsDebuggerPresent		failed	0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620762787.06325 GlobalMemoryStatusEx		success	1	0

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620762786.28125 GetDiskFreeSpaceExW	root_path: C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7ZipSfx.000 free_bytes_available: 19609403392 total_number_of_free_bytes: 0 total_number_of_bytes: 0	success	1	0

Creates executable files on the filesystem (6 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7ZipSfx.000\bin\config.js
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7ZipSfx.000\bin\Tools\patch.reg
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7ZipSfx.000\bin\languages\en.js
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7ZipSfx.000\bin\update-template.js
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7ZipSfx.000\bin\drp.js
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\7ZipSfx.000\bin\languages\ru.js

Creates a suspicious process (2 个事件)

cmdline	"C:\Windows\System32\mshta.exe" "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7ZipSfx.000\bin\run.hta" --sfx "5dab92f76c835b7d53075dfbae018f3a.exe"
cmdline	mshta.exe "C:\Users\ADMINI~1.OSK\AppData\Local\Temp\7ZipSfx.000\bin\run.hta" --sfx "5dab92f76c835b7d53075dfbae018f3a.exe"

Communicates with host for which no DNS query was performed (2 个事件)

host	113.108.239.196
host	172.217.24.14

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 个事件)

FireEye	Generic.mg.5dab92f76c835b7d
Sangfor	Malware
CrowdStrike	win/malicious_confidence_60% (W)
APEX	Malicious
Invincea	heuristic
Jiangmin	Trojan.Generic.amval
Endgame	malicious (high confidence)
AegisLab	Trojan.Win32.Generic.4!c
eGambit	Unsafe.AI_Score_100%
Cybereason	malicious.29f0ce

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2016-04-03 06:14:34

Imports

Library COMCTL32.dll:

• 0x41d010

Library SHELL32.dll:

• 0x41d274 ShellExecuteExW

• 0x41d278 ShellExecuteW

• 0x41d27c SHGetMalloc

• 0x41d280 SHGetPathFromIDListW

• 0x41d284 SHBrowseForFolderW

• 0x41d288 SHGetFileInfoW

• 0x41d28c SHGetSpecialFolderPathW

Library GDI32.dll:

• 0x41d018 CreateCompatibleDC

• 0x41d01c CreateFontIndirectW

• 0x41d020 DeleteObject

• 0x41d024 DeleteDC

• 0x41d028 GetCurrentObject

• 0x41d02c StretchBlt

• 0x41d030 GetDeviceCaps

• 0x41d034 CreateCompatibleBitmap

• 0x41d038 SelectObject

• 0x41d03c SetStretchBltMode

• 0x41d040 GetObjectW

Library ADVAPI32.dll:

• 0x41d000 FreeSid

• 0x41d004 AllocateAndInitializeSid

• 0x41d008 CheckTokenMembership

Library USER32.dll:

• 0x41d294 GetParent

• 0x41d298 ScreenToClient

• 0x41d29c CreateWindowExW

• 0x41d2a0 GetDesktopWindow

• 0x41d2a4 GetWindowTextLengthW

• 0x41d2a8 SetWindowPos

• 0x41d2ac SetTimer

• 0x41d2b0 GetMessageW

• 0x41d2b4 CopyImage

• 0x41d2b8 KillTimer

• 0x41d2bc CharUpperW

• 0x41d2c0 SendMessageW

• 0x41d2c4 ShowWindow

• 0x41d2c8 BringWindowToTop

• 0x41d2cc wsprintfW

• 0x41d2d0 MessageBoxW

• 0x41d2d4 EndDialog

• 0x41d2d8 ReleaseDC

• 0x41d2dc GetWindowDC

• 0x41d2e0 GetMenu

• 0x41d2e4 GetWindowLongW

• 0x41d2e8 GetClassNameA

• 0x41d2ec wsprintfA

• 0x41d2f0 DispatchMessageW

• 0x41d2f4 SetWindowTextW

• 0x41d2f8 GetSysColor

• 0x41d2fc DestroyWindow

• 0x41d300 MessageBoxA

• 0x41d304 GetKeyState

• 0x41d308 IsWindow

• 0x41d30c GetDlgItem

• 0x41d310 GetClientRect

• 0x41d314 GetSystemMetrics

• 0x41d318 SetWindowLongW

• 0x41d31c UnhookWindowsHookEx

• 0x41d320 SetFocus

• 0x41d324 SystemParametersInfoW

• 0x41d328 DrawTextW

• 0x41d32c GetDC

• 0x41d330 ClientToScreen

• 0x41d334 GetWindow

• 0x41d338 DialogBoxIndirectParamW

• 0x41d33c DrawIconEx

• 0x41d340 CallWindowProcW

• 0x41d344 DefWindowProcW

• 0x41d348 CallNextHookEx

• 0x41d34c PtInRect

• 0x41d350 SetWindowsHookExW

• 0x41d354 LoadImageW

• 0x41d358 LoadIconW

• 0x41d35c MessageBeep

• 0x41d360 EnableWindow

• 0x41d364 EnableMenuItem

• 0x41d368 GetSystemMenu

• 0x41d36c CreateWindowExA

• 0x41d370 wvsprintfW

• 0x41d374 GetWindowTextW

• 0x41d378 GetWindowRect

Library ole32.dll:

• 0x41d380 CreateStreamOnHGlobal

• 0x41d384 CoCreateInstance

• 0x41d388 CoInitialize

Library OLEAUT32.dll:

• 0x41d25c SysAllocStringLen

• 0x41d260 VariantClear

• 0x41d264 SysFreeString

• 0x41d268 OleLoadPicture

• 0x41d26c SysAllocString

Library KERNEL32.dll:

• 0x41d048 SetFileTime

• 0x41d04c SetEndOfFile

• 0x41d050 GetFileInformationByHandle

• 0x41d054 VirtualFree

• 0x41d058 GetModuleHandleA

• 0x41d05c WaitForMultipleObjects

• 0x41d060 VirtualAlloc

• 0x41d064 ReadFile

• 0x41d068 SetFilePointer

• 0x41d06c GetFileSize

• 0x41d070 LeaveCriticalSection

• 0x41d074 EnterCriticalSection

• 0x41d078 DeleteCriticalSection

• 0x41d07c FormatMessageW

• 0x41d080 lstrcpyW

• 0x41d084 LocalFree

• 0x41d088 IsBadReadPtr

• 0x41d08c GetSystemDirectoryW

• 0x41d090 GetCurrentThreadId

• 0x41d094 SuspendThread

• 0x41d098 TerminateThread

• 0x41d09c InitializeCriticalSection

• 0x41d0a0 ResetEvent

• 0x41d0a4 SetEvent

• 0x41d0a8 CreateEventW

• 0x41d0ac GetVersionExW

• 0x41d0b0 GetModuleFileNameW

• 0x41d0b4 GetCurrentProcess

• 0x41d0b8 SetProcessWorkingSetSize

• 0x41d0bc SetEnvironmentVariableW

• 0x41d0c0 GetDriveTypeW

• 0x41d0c4 CreateFileW

• 0x41d0c8 LoadLibraryA

• 0x41d0cc SetThreadLocale

• 0x41d0d0 GetSystemTimeAsFileTime

• 0x41d0d4 ExpandEnvironmentStringsW

• 0x41d0d8 CompareFileTime

• 0x41d0dc WideCharToMultiByte

• 0x41d0e0 GetTempPathW

• 0x41d0e4 GetCurrentDirectoryW

• 0x41d0e8 GetEnvironmentVariableW

• 0x41d0ec lstrcmpiW

• 0x41d0f0 GetLocaleInfoW

• 0x41d0f4 MultiByteToWideChar

• 0x41d0f8 GetUserDefaultUILanguage

• 0x41d0fc GetSystemDefaultUILanguage

• 0x41d100 GetSystemDefaultLCID

• 0x41d104 lstrcmpiA

• 0x41d108 GlobalAlloc

• 0x41d10c GlobalFree

• 0x41d110 MulDiv

• 0x41d114 FindResourceExA

• 0x41d118 SizeofResource

• 0x41d11c LoadResource

• 0x41d120 LockResource

• 0x41d124 GetModuleHandleW

• 0x41d128 FindFirstFileW

• 0x41d12c lstrcmpW

• 0x41d130 DeleteFileW

• 0x41d134 FindNextFileW

• 0x41d138 FindClose

• 0x41d13c RemoveDirectoryW

• 0x41d140 GetStdHandle

• 0x41d144 WriteFile

• 0x41d148 lstrlenA

• 0x41d14c CreateDirectoryW

• 0x41d150 GetFileAttributesW

• 0x41d154 SetCurrentDirectoryW

• 0x41d158 GetLocalTime

• 0x41d15c SystemTimeToFileTime

• 0x41d160 CreateThread

• 0x41d164 GetExitCodeThread

• 0x41d168 Sleep

• 0x41d16c SetFileAttributesW

• 0x41d170 GetDiskFreeSpaceExW

• 0x41d174 SetLastError

• 0x41d178 GetTickCount

• 0x41d17c lstrlenW

• 0x41d180 ExitProcess

• 0x41d184 lstrcatW

• 0x41d188 GetProcAddress

• 0x41d18c CloseHandle

• 0x41d190 WaitForSingleObject

• 0x41d194 GetExitCodeProcess

• 0x41d198 GetQueuedCompletionStatus

• 0x41d19c ResumeThread

• 0x41d1a0 SetInformationJobObject

• 0x41d1a4 CreateIoCompletionPort

• 0x41d1a8 AssignProcessToJobObject

• 0x41d1ac CreateJobObjectW

• 0x41d1b0 GetLastError

• 0x41d1b4 CreateProcessW

• 0x41d1b8 GetStartupInfoW

• 0x41d1bc GetCommandLineW

• 0x41d1c0 GetStartupInfoA

Library MSVCRT.dll:

• 0x41d1c8 _purecall

• 0x41d1cc ??2@YAPAXI@Z

• 0x41d1d0 _wtol

• 0x41d1d4 memset

• 0x41d1d8 memmove

• 0x41d1dc memcpy

• 0x41d1e0 _wcsnicmp

• 0x41d1e4 _controlfp

• 0x41d1e8 _except_handler3

• 0x41d1ec __set_app_type

• 0x41d1f0 __p__fmode

• 0x41d1f4 __p__commode

• 0x41d1f8 _adjust_fdiv

• 0x41d1fc __setusermatherr

• 0x41d200 _initterm

• 0x41d204 __getmainargs

• 0x41d208 _acmdln

• 0x41d20c exit

• 0x41d210 _XcptFilter

• 0x41d214 _exit

• 0x41d218 ??1type_info@@UAE@XZ

• 0x41d21c _onexit

• 0x41d220 __dllonexit

• 0x41d224 malloc

• 0x41d228 realloc

• 0x41d22c free

• 0x41d230 wcsstr

• 0x41d234 _CxxThrowException

• 0x41d238 _beginthreadex

• 0x41d23c _EH_prolog

• 0x41d240 ?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z

• 0x41d244 strncmp

• 0x41d248 wcsncmp

• 0x41d24c wcsncpy

• 0x41d250 strncpy

• 0x41d254 ??3@YAXPAX@Z

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com A 172.217.160.110	216.58.200.78
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	53380	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355
192.168.56.101	62912	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.