SmartHawk

2.8

中危

该样本未表现出任何异常！

7c3c41d8da242f6ae707daaf842c0c0afb4ff541e3b009c62e51bc7d93eca86b

5f675b2769cc5189ab4dfc06a13cff46.exe

分析耗时

83s

最近分析

文件大小

2.4MB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

This executable is signed

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.HSdata

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.999913490819406

section

{'size_of_data': '0x00226200', 'virtual_address': '0x000ad000', 'entropy': 7.999913490819406, 'name': '.HSdata', 'virtual_size': '0x00227000'}

description

A section with a high entropy has been found

entropy

0.8832028898254064

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-09-08 07:31:04

Imports

Library KERNEL32.dll:

• 0x40800c CloseHandle

• 0x408010 GetFileSize

• 0x408014 VirtualFree

• 0x408018 FreeLibrary

• 0x40801c LoadLibraryA

• 0x408020 GetComputerNameA

• 0x408024 GetCurrentProcess

• 0x408028 InitializeSListHead

• 0x40802c GetSystemTimeAsFileTime

• 0x408030 GetCurrentThreadId

• 0x408034 CreateFileA

• 0x408038 VirtualAlloc

• 0x40803c ExpandEnvironmentStringsA

• 0x408040 GetCurrentProcessId

• 0x408044 QueryPerformanceCounter

• 0x408048 GetStartupInfoW

• 0x40804c SetUnhandledExceptionFilter

• 0x408050 UnhandledExceptionFilter

• 0x408054 IsDebuggerPresent

• 0x408058 IsProcessorFeaturePresent

• 0x40805c GetProcAddress

• 0x408060 GetModuleHandleW

• 0x408064 CreateEventW

• 0x408068 WaitForSingleObjectEx

• 0x40806c ResetEvent

• 0x408070 SetEvent

• 0x408074 DeleteCriticalSection

• 0x408078 InitializeCriticalSectionAndSpinCount

• 0x40807c LeaveCriticalSection

• 0x408080 EnterCriticalSection

• 0x408084 TerminateProcess

Library USER32.dll:

• 0x4080f0 GetWindowRect

• 0x4080f4 GetDesktopWindow

Library ADVAPI32.dll:

• 0x408000 GetUserNameA

• 0x408004 RegOpenKeyExA

Library MSVCP140.dll:

• 0x40808c ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

• 0x408090 ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ

• 0x408094 ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

• 0x408098 ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ

• 0x40809c ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z

• 0x4080a0 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ

• 0x4080a4 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z

• 0x4080a8 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z

• 0x4080ac ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z

• 0x4080b0 ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z

• 0x4080b4 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ

• 0x4080b8 ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z

• 0x4080bc ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

• 0x4080c0 ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

• 0x4080c4 ?width@ios_base@std@@QAE_J_J@Z

• 0x4080c8 ?width@ios_base@std@@QBE_JXZ

• 0x4080cc ?flags@ios_base@std@@QBEHXZ

• 0x4080d0 ?good@ios_base@std@@QBE_NXZ

• 0x4080d4 ??Bios_base@std@@QBE_NXZ

• 0x4080d8 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

• 0x4080dc ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z

• 0x4080e0 ?uncaught_exception@std@@YA_NXZ

Library SHLWAPI.dll:

• 0x4080e8 StrStrIA

Library VCRUNTIME140.dll:

• 0x4080fc memmove

• 0x408100 _CxxThrowException

• 0x408104 memset

• 0x408108 __std_exception_copy

• 0x40810c memcpy

• 0x408110 _purecall

• 0x408114 _except_handler4_common

• 0x408118 __std_exception_destroy

• 0x40811c __CxxFrameHandler3

Library api-ms-win-crt-runtime-l1-1-0.dll:

• 0x408144 _c_exit

• 0x408148 _exit

• 0x40814c terminate

• 0x408150 _controlfp_s

• 0x408154 _initterm_e

• 0x408158 _initterm

• 0x40815c exit

• 0x408160 _get_narrow_winmain_command_line

• 0x408164 _register_thread_local_exe_atexit_callback

• 0x408168 _set_app_type

• 0x40816c _seh_filter_exe

• 0x408170 _cexit

• 0x408174 _crt_atexit

• 0x408178 _initialize_onexit_table

• 0x40817c _initialize_narrow_environment

• 0x408180 _configure_narrow_argv

• 0x408184 _register_onexit_function

Library api-ms-win-crt-heap-l1-1-0.dll:

• 0x408124 _callnewh

• 0x408128 malloc

• 0x40812c _set_new_mode

Library api-ms-win-crt-stdio-l1-1-0.dll:

• 0x40818c __stdio_common_vfscanf

• 0x408190 __stdio_common_vfprintf

• 0x408194 _set_fmode

• 0x408198 __acrt_iob_func

• 0x40819c __p__commode

Library api-ms-win-crt-math-l1-1-0.dll:

• 0x40813c __setusermatherr

Library api-ms-win-crt-locale-l1-1-0.dll:

• 0x408134 _configthreadlocale

Exports

Ordinal	Address	Name
1	0x406a00	free

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	216.58.200.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.