SmartHawk

5.0

中危

该样本未表现出任何异常！

重新分析

下载样本

b2d3fb5275d039b25527292b1b2814354b2a3e3b2e8acafe02d507a31a66718c

61130ba71d2bb0f5285e38687960a8c8.exe

分析耗时

97s

最近分析

文件大小

1.8MB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

The file contains an unknown PE resource name possibly indicative of a packer (2 个事件)

resource name	MUI
resource name	WEVT_TEMPLATE

Allocates read-write-execute memory (usually to unpack itself) (4 个事件)

Time & API	Arguments	Status
1620762826.65675 NtAllocateVirtualMemory	process_identifier: 2632 region_size: 1777664 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x01f90000	success
1620762826.65675 NtAllocateVirtualMemory	process_identifier: 2632 region_size: 1773568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02150000	success
1620762826.67275 NtAllocateVirtualMemory	process_identifier: 2632 region_size: 1871872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x02310000	success
1620762826.78175 NtAllocateVirtualMemory	process_identifier: 2632 region_size: 1871872 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00400000	success

A process attempted to delay the analysis task. (1 个事件)

description

61130ba71d2bb0f5285e38687960a8c8.exe tried to sleep 155 seconds, actually delayed analysis time by 155 seconds

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620762831.65675 GetAdaptersAddresses	flags: 1158 family: 0	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (3 个事件)

entropy

7.605020267623976

section

{'size_of_data': '0x001b2e00', 'virtual_address': '0x00001000', 'entropy': 7.605020267623976, 'name': '.text', 'virtual_size': '0x001b2d5b'}

description

A section with a high entropy has been found

entropy

7.1513507268016685

section

{'size_of_data': '0x00015400', 'virtual_address': '0x001c5000', 'entropy': 7.1513507268016685, 'name': '.rsrc', 'virtual_size': '0x000153d8'}

description

A section with a high entropy has been found

entropy

0.9658549497088407

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (6 个事件)

host	124.225.105.97
host	151.139.128.14
host	172.217.24.14
host	31.44.184.120
host	216.58.200.78
host	52.218.62.116

Installs itself for autorun at Windows startup (1 个事件)

service_name

s3svc

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\61130ba71d2bb0f5285e38687960a8c8.exe -r

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620762831.03175 CreateServiceA	service_start_name: start_type: 2 service_handle: 0x007502b0 display_name: Enterprise Mailing Service error_control: 1 service_name: s3svc filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\61130ba71d2bb0f5285e38687960a8c8.exe -r filepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\61130ba71d2bb0f5285e38687960a8c8.exe -r service_manager_handle: 0x00750260 desired_access: 983551 service_type: 16 password:	success	7668400	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2018-04-26 18:08:44

Imports

Library KERNEL32.dll:

• 0x5b4198 SetLastError

• 0x5b419c VirtualAllocEx

• 0x5b41a0 Sleep

• 0x5b41a4 GetModuleHandleA

• 0x5b41a8 CloseHandle

• 0x5b41ac CreateFileA

• 0x5b41b0 DeleteCriticalSection

• 0x5b41b4 ExitProcess

• 0x5b41b8 FlushFileBuffers

• 0x5b41bc FreeEnvironmentStringsA

• 0x5b41c0 FreeEnvironmentStringsW

• 0x5b41c4 GetCommandLineA

• 0x5b41c8 GetConsoleCP

• 0x5b41cc GetConsoleMode

• 0x5b41d0 GetConsoleOutputCP

• 0x5b41d4 GetCurrentThreadId

• 0x5b41d8 GetEnvironmentStrings

• 0x5b41dc GetEnvironmentStringsW

• 0x5b41e0 GetFileType

• 0x5b41e4 GetLastError

• 0x5b41e8 GetModuleFileNameA

• 0x5b41ec GetModuleHandleW

• 0x5b41f0 GetProcAddress

• 0x5b41f4 GetStartupInfoA

• 0x5b41f8 GetStdHandle

• 0x5b41fc GetStringTypeA

• 0x5b4200 WriteFile

• 0x5b4204 WriteConsoleW

• 0x5b4208 WriteConsoleA

• 0x5b420c WideCharToMultiByte

• 0x5b4210 VirtualFree

• 0x5b4214 TlsSetValue

• 0x5b4218 TlsGetValue

• 0x5b421c TlsFree

• 0x5b4220 TlsAlloc

• 0x5b4224 SetUnhandledExceptionFilter

• 0x5b4228 SetStdHandle

• 0x5b422c LoadLibraryA

• 0x5b4230 SetHandleCount

• 0x5b4234 SetFilePointer

• 0x5b4238 QueryPerformanceCounter

• 0x5b423c MultiByteToWideChar

• 0x5b4240 LCMapStringW

• 0x5b4244 LCMapStringA

• 0x5b4248 InterlockedIncrement

• 0x5b424c InterlockedDecrement

• 0x5b4250 HeapFree

• 0x5b4254 HeapCreate

• 0x5b4258 GetTickCount

• 0x5b425c GetStringTypeW

Library USER32.dll:

• 0x5b4264 LoadCursorA

• 0x5b4268 IsWindowVisible

• 0x5b426c GetDC

• 0x5b4270 IsCharAlphaNumericW

• 0x5b4274 CopyIcon

• 0x5b4278 GetDialogBaseUnits

• 0x5b427c CallWindowProcA

• 0x5b4280 EnableWindow

• 0x5b4284 GetCursorPos

• 0x5b4288 GetMenuItemID

• 0x5b428c GetSubMenu

• 0x5b4290 KillTimer

• 0x5b4294 LoadIconA

• 0x5b4298 LoadMenuA

• 0x5b429c LoadStringA

• 0x5b42a0 MessageBoxA

• 0x5b42a4 PostMessageA

• 0x5b42a8 RegisterWindowMessageA

• 0x5b42ac SendMessageA

• 0x5b42b0 SetForegroundWindow

• 0x5b42b4 SetMenuDefaultItem

• 0x5b42b8 SetTimer

• 0x5b42bc SetWindowLongA

• 0x5b42c0 TrackPopupMenu

• 0x5b42c4 wsprintfA

Library GDI32.dll:

• 0x5b400c UnrealizeObject

• 0x5b4010 TextOutA

• 0x5b4014 StretchDIBits

• 0x5b4018 StretchBlt

• 0x5b401c StartPage

• 0x5b4020 StartDocW

• 0x5b4024 StartDocA

• 0x5b4028 SetWindowOrgEx

• 0x5b402c SetWinMetaFileBits

• 0x5b4030 SetViewportOrgEx

• 0x5b4034 SetTextColor

• 0x5b4038 SetStretchBltMode

• 0x5b403c SetROP2

• 0x5b4040 SetPixel

• 0x5b4044 SetMapMode

• 0x5b4048 SetEnhMetaFileBits

• 0x5b404c SetDIBColorTable

• 0x5b4050 SetBrushOrgEx

• 0x5b4054 SetBkMode

• 0x5b4058 SetBkColor

• 0x5b405c SetAbortProc

• 0x5b4060 SelectPalette

• 0x5b4064 SelectObject

• 0x5b4068 SelectClipRgn

• 0x5b406c SaveDC

• 0x5b4070 RestoreDC

• 0x5b4074 ResizePalette

• 0x5b4078 Rectangle

• 0x5b407c RectVisible

• 0x5b4080 RealizePalette

• 0x5b4084 Polyline

• 0x5b4088 PlayEnhMetaFile

• 0x5b408c PatBlt

• 0x5b4090 MoveToEx

• 0x5b4094 MaskBlt

• 0x5b4098 LineTo

• 0x5b409c IntersectClipRect

• 0x5b40a0 GetWindowOrgEx

• 0x5b40a4 GetWinMetaFileBits

• 0x5b40a8 GetViewportOrgEx

• 0x5b40ac GetTextMetricsW

• 0x5b40b0 GetTextFaceA

• 0x5b40b4 GetTextExtentPointW

• 0x5b40b8 GetTextExtentPoint32W

• 0x5b40bc GetTextExtentPoint32A

• 0x5b40c0 GetSystemPaletteEntries

• 0x5b40c4 GetStockObject

• 0x5b40c8 GetRgnBox

• 0x5b40cc GetPixel

• 0x5b40d0 GetPaletteEntries

• 0x5b40d4 GetObjectW

• 0x5b40d8 GetObjectType

• 0x5b40dc GetNearestPaletteIndex

• 0x5b40e0 GetEnhMetaFilePaletteEntries

• 0x5b40e4 GetEnhMetaFileHeader

• 0x5b40e8 GetEnhMetaFileBits

• 0x5b40ec GetDeviceCaps

• 0x5b40f0 GetDIBits

• 0x5b40f4 GetDIBColorTable

• 0x5b40f8 GetDCOrgEx

• 0x5b40fc GetCurrentPositionEx

• 0x5b4100 GetCurrentObject

• 0x5b4104 GetClipRgn

• 0x5b4108 GetClipBox

• 0x5b410c GetBrushOrgEx

• 0x5b4110 GetBitmapBits

• 0x5b4114 GdiFlush

• 0x5b4118 FrameRgn

• 0x5b411c ExtTextOutW

• 0x5b4120 ExcludeClipRect

• 0x5b4124 EndPage

• 0x5b4128 EndDoc

• 0x5b412c DeleteObject

• 0x5b4130 BitBlt

• 0x5b4134 CombineRgn

• 0x5b4138 CopyEnhMetaFileW

• 0x5b413c CreateBitmap

• 0x5b4140 CreateBrushIndirect

• 0x5b4144 CreateCompatibleBitmap

• 0x5b4148 CreateCompatibleDC

• 0x5b414c CreateDCW

• 0x5b4150 CreateDIBSection

• 0x5b4154 CreateDIBitmap

• 0x5b4158 CreateFontA

• 0x5b415c CreateFontIndirectA

• 0x5b4160 CreateFontIndirectW

• 0x5b4164 CreateFontW

• 0x5b4168 CreateHalftonePalette

• 0x5b416c CreateICW

• 0x5b4170 CreatePalette

• 0x5b4174 CreatePen

• 0x5b4178 CreatePenIndirect

• 0x5b417c CreateRectRgn

• 0x5b4180 CreateRectRgnIndirect

• 0x5b4184 CreateRoundRectRgn

• 0x5b4188 CreateSolidBrush

• 0x5b418c DeleteDC

• 0x5b4190 DeleteEnhMetaFile

Library ADVAPI32.dll:

• 0x5b4000 RegQueryValueExA

• 0x5b4004 RegOpenKeyA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	216.58.200.78
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

Source	Source Port	Destination	Destination Port
52.218.62.116	80	192.168.56.101	49220

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	62318	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.