SmartHawk

4.0

中危

该样本未表现出任何异常！

重新分析

下载样本

ece26faace5bcf7afeba359279d17aeb7f99f739fce454e964c88ebad9745bdb

629e124eff07f0d656e30939bec28af9.exe

分析耗时

93s

Time & API	Arguments	Status	Return	Repeated
1619610654.749375 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x01e10000	success	0	0
1619610700.968375 NtAllocateVirtualMemory	process_identifier: 2288 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02010000	success	0	0

Time & API	Arguments	Status	Return	Repeated
1619610717.984375 RegSetValueExA	key_handle: 0x000002ac value: 0 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	success	0	0

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x4eb168 DeleteCriticalSection

• 0x4eb16c LeaveCriticalSection

• 0x4eb170 EnterCriticalSection

• 0x4eb174 InitializeCriticalSection

• 0x4eb178 VirtualFree

• 0x4eb17c VirtualAlloc

• 0x4eb180 LocalFree

• 0x4eb184 LocalAlloc

• 0x4eb188 GetTickCount

• 0x4eb18c QueryPerformanceCounter

• 0x4eb190 GetVersion

• 0x4eb194 GetCurrentThreadId

• 0x4eb198 InterlockedDecrement

• 0x4eb19c InterlockedIncrement

• 0x4eb1a0 VirtualQuery

• 0x4eb1a4 WideCharToMultiByte

• 0x4eb1a8 MultiByteToWideChar

• 0x4eb1ac lstrlenA

• 0x4eb1b0 lstrcpynA

• 0x4eb1b4 LoadLibraryExA

• 0x4eb1b8 GetThreadLocale

• 0x4eb1bc GetStartupInfoA

• 0x4eb1c0 GetProcAddress

• 0x4eb1c4 GetModuleHandleA

• 0x4eb1c8 GetModuleFileNameA

• 0x4eb1cc GetLocaleInfoA

• 0x4eb1d0 GetCommandLineA

• 0x4eb1d4 FreeLibrary

• 0x4eb1d8 FindFirstFileA

• 0x4eb1dc FindClose

• 0x4eb1e0 ExitProcess

• 0x4eb1e4 WriteFile

• 0x4eb1e8 UnhandledExceptionFilter

• 0x4eb1ec RtlUnwind

• 0x4eb1f0 RaiseException

• 0x4eb1f4 GetStdHandle

Library user32.dll:

• 0x4eb1fc GetKeyboardType

• 0x4eb200 LoadStringA

• 0x4eb204 MessageBoxA

• 0x4eb208 CharNextA

Library advapi32.dll:

• 0x4eb210 RegQueryValueExA

• 0x4eb214 RegOpenKeyExA

• 0x4eb218 RegCloseKey

Library oleaut32.dll:

• 0x4eb220 SysFreeString

• 0x4eb224 SysReAllocStringLen

• 0x4eb228 SysAllocStringLen

Library kernel32.dll:

• 0x4eb230 TlsSetValue

• 0x4eb234 TlsGetValue

• 0x4eb238 LocalAlloc

• 0x4eb23c GetModuleHandleA

Library advapi32.dll:

• 0x4eb244 RegQueryValueExA

• 0x4eb248 RegOpenKeyExA

• 0x4eb24c RegCloseKey

Library kernel32.dll:

• 0x4eb254 lstrcpyA

• 0x4eb258 WriteFile

• 0x4eb25c WaitForSingleObject

• 0x4eb260 VirtualQuery

• 0x4eb264 VirtualProtect

• 0x4eb268 VirtualAlloc

• 0x4eb26c Sleep

• 0x4eb270 SizeofResource

• 0x4eb274 SetThreadLocale

• 0x4eb278 SetFilePointer

• 0x4eb27c SetEvent

• 0x4eb280 SetErrorMode

• 0x4eb284 SetEndOfFile

• 0x4eb288 ResetEvent

• 0x4eb28c ReadFile

• 0x4eb290 MultiByteToWideChar

• 0x4eb294 MulDiv

• 0x4eb298 LockResource

• 0x4eb29c LoadResource

• 0x4eb2a0 LoadLibraryA

• 0x4eb2a4 LeaveCriticalSection

• 0x4eb2a8 InitializeCriticalSection

• 0x4eb2ac GlobalUnlock

• 0x4eb2b0 GlobalReAlloc

• 0x4eb2b4 GlobalHandle

• 0x4eb2b8 GlobalLock

• 0x4eb2bc GlobalFree

• 0x4eb2c0 GlobalFindAtomA

• 0x4eb2c4 GlobalDeleteAtom

• 0x4eb2c8 GlobalAlloc

• 0x4eb2cc GlobalAddAtomA

• 0x4eb2d0 GetVersionExA

• 0x4eb2d4 GetVersion

• 0x4eb2d8 GetTickCount

• 0x4eb2dc GetThreadLocale

• 0x4eb2e0 GetSystemInfo

• 0x4eb2e4 GetStringTypeExA

• 0x4eb2e8 GetStdHandle

• 0x4eb2ec GetProcAddress

• 0x4eb2f0 GetModuleHandleA

• 0x4eb2f4 GetModuleFileNameA

• 0x4eb2f8 GetLocaleInfoA

• 0x4eb2fc GetLocalTime

• 0x4eb300 GetLastError

• 0x4eb304 GetFullPathNameA

• 0x4eb308 GetDiskFreeSpaceA

• 0x4eb30c GetDateFormatA

• 0x4eb310 GetCurrentThreadId

• 0x4eb314 GetCurrentProcessId

• 0x4eb318 GetCPInfo

• 0x4eb31c GetACP

• 0x4eb320 FreeResource

• 0x4eb324 InterlockedExchange

• 0x4eb328 FreeLibrary

• 0x4eb32c FormatMessageA

• 0x4eb330 FindResourceA

• 0x4eb334 EnumCalendarInfoA

• 0x4eb338 EnterCriticalSection

• 0x4eb33c DeleteCriticalSection

• 0x4eb340 CreateThread

• 0x4eb344 CreateFileA

• 0x4eb348 CreateEventA

• 0x4eb34c CompareStringA

• 0x4eb350 CloseHandle

Library version.dll:

• 0x4eb358 VerQueryValueA

• 0x4eb35c GetFileVersionInfoSizeA

• 0x4eb360 GetFileVersionInfoA

Library gdi32.dll:

• 0x4eb368 UnrealizeObject

• 0x4eb36c StretchBlt

• 0x4eb370 SetWindowOrgEx

• 0x4eb374 SetWinMetaFileBits

• 0x4eb378 SetViewportOrgEx

• 0x4eb37c SetTextColor

• 0x4eb380 SetStretchBltMode

• 0x4eb384 SetROP2

• 0x4eb388 SetPixel

• 0x4eb38c SetEnhMetaFileBits

• 0x4eb390 SetDIBColorTable

• 0x4eb394 SetBrushOrgEx

• 0x4eb398 SetBkMode

• 0x4eb39c SetBkColor

• 0x4eb3a0 SelectPalette

• 0x4eb3a4 SelectObject

• 0x4eb3a8 SaveDC

• 0x4eb3ac RestoreDC

• 0x4eb3b0 Rectangle

• 0x4eb3b4 RectVisible

• 0x4eb3b8 RealizePalette

• 0x4eb3bc Polyline

• 0x4eb3c0 PlayEnhMetaFile

• 0x4eb3c4 PatBlt

• 0x4eb3c8 MoveToEx

• 0x4eb3cc MaskBlt

• 0x4eb3d0 LineTo

• 0x4eb3d4 IntersectClipRect

• 0x4eb3d8 GetWindowOrgEx

• 0x4eb3dc GetWinMetaFileBits

• 0x4eb3e0 GetTextMetricsA

• 0x4eb3e4 GetTextExtentPoint32A

• 0x4eb3e8 GetSystemPaletteEntries

• 0x4eb3ec GetStockObject

• 0x4eb3f0 GetPolyFillMode

• 0x4eb3f4 GetPixel

• 0x4eb3f8 GetPaletteEntries

• 0x4eb3fc GetObjectA

• 0x4eb400 GetMapMode

• 0x4eb404 GetEnhMetaFilePaletteEntries

• 0x4eb408 GetEnhMetaFileHeader

• 0x4eb40c GetEnhMetaFileBits

• 0x4eb410 GetDeviceCaps

• 0x4eb414 GetDIBits

• 0x4eb418 GetDIBColorTable

• 0x4eb41c GetDCOrgEx

• 0x4eb420 GetDCPenColor

• 0x4eb424 GetCurrentPositionEx

• 0x4eb428 GetClipBox

• 0x4eb42c GetBrushOrgEx

• 0x4eb430 GetBitmapBits

• 0x4eb434 ExtTextOutA

• 0x4eb438 ExcludeClipRect

• 0x4eb43c DeleteObject

• 0x4eb440 DeleteEnhMetaFile

• 0x4eb444 DeleteDC

• 0x4eb448 CreateSolidBrush

• 0x4eb44c CreatePenIndirect

• 0x4eb450 CreatePalette

• 0x4eb454 CreateHalftonePalette

• 0x4eb458 CreateFontIndirectA

• 0x4eb45c CreateDIBitmap

• 0x4eb460 CreateDIBSection

• 0x4eb464 CreateCompatibleDC

• 0x4eb468 CreateCompatibleBitmap

• 0x4eb46c CreateBrushIndirect

• 0x4eb470 CreateBitmap

• 0x4eb474 CopyEnhMetaFileA

• 0x4eb478 BitBlt

Library user32.dll:

• 0x4eb480 CreateWindowExA

• 0x4eb484 WindowFromPoint

• 0x4eb488 WinHelpA

• 0x4eb48c WaitMessage

• 0x4eb490 UpdateWindow

• 0x4eb494 UnregisterClassA

• 0x4eb498 UnhookWindowsHookEx

• 0x4eb49c TranslateMessage

• 0x4eb4a0 TranslateMDISysAccel

• 0x4eb4a4 TrackPopupMenu

• 0x4eb4a8 SystemParametersInfoA

• 0x4eb4ac ShowWindow

• 0x4eb4b0 ShowScrollBar

• 0x4eb4b4 ShowOwnedPopups

• 0x4eb4b8 ShowCursor

• 0x4eb4bc SetWindowsHookExA

• 0x4eb4c0 SetWindowTextA

• 0x4eb4c4 SetWindowPos

• 0x4eb4c8 SetWindowPlacement

• 0x4eb4cc SetWindowLongA

• 0x4eb4d0 SetTimer

• 0x4eb4d4 SetScrollRange

• 0x4eb4d8 SetScrollPos

• 0x4eb4dc SetScrollInfo

• 0x4eb4e0 SetRect

• 0x4eb4e4 SetPropA

• 0x4eb4e8 SetParent

• 0x4eb4ec SetMenuItemInfoA

• 0x4eb4f0 SetMenu

• 0x4eb4f4 SetKeyboardState

• 0x4eb4f8 SetForegroundWindow

• 0x4eb4fc SetFocus

• 0x4eb500 SetCursor

• 0x4eb504 SetClipboardData

• 0x4eb508 SetClassLongA

• 0x4eb50c SetCapture

• 0x4eb510 SetActiveWindow

• 0x4eb514 SendMessageA

• 0x4eb518 ScrollWindow

• 0x4eb51c ScreenToClient

• 0x4eb520 RemovePropA

• 0x4eb524 RemoveMenu

• 0x4eb528 ReleaseDC

• 0x4eb52c ReleaseCapture

• 0x4eb530 RegisterWindowMessageA

• 0x4eb534 RegisterClipboardFormatA

• 0x4eb538 RegisterClassA

• 0x4eb53c RedrawWindow

• 0x4eb540 PtInRect

• 0x4eb544 PostQuitMessage

• 0x4eb548 PostMessageA

• 0x4eb54c PeekMessageA

• 0x4eb550 OpenClipboard

• 0x4eb554 OffsetRect

• 0x4eb558 OemToCharA

• 0x4eb55c MessageBoxA

• 0x4eb560 MessageBeep

• 0x4eb564 MapWindowPoints

• 0x4eb568 MapVirtualKeyA

• 0x4eb56c LoadStringA

• 0x4eb570 LoadKeyboardLayoutA

• 0x4eb574 LoadIconA

• 0x4eb578 LoadCursorA

• 0x4eb57c LoadBitmapA

• 0x4eb580 KillTimer

• 0x4eb584 IsZoomed

• 0x4eb588 IsWindowVisible

• 0x4eb58c IsWindowEnabled

• 0x4eb590 IsWindow

• 0x4eb594 IsRectEmpty

• 0x4eb598 IsIconic

• 0x4eb59c IsDialogMessageA

• 0x4eb5a0 IsChild

• 0x4eb5a4 IsCharAlphaNumericA

• 0x4eb5a8 IsCharAlphaA

• 0x4eb5ac InvalidateRect

• 0x4eb5b0 IntersectRect

• 0x4eb5b4 InsertMenuItemA

• 0x4eb5b8 InsertMenuA

• 0x4eb5bc InflateRect

• 0x4eb5c0 GetWindowThreadProcessId

• 0x4eb5c4 GetWindowTextA

• 0x4eb5c8 GetWindowRect

• 0x4eb5cc GetWindowPlacement

• 0x4eb5d0 GetWindowLongA

• 0x4eb5d4 GetWindowDC

• 0x4eb5d8 GetTopWindow

• 0x4eb5dc GetSystemMetrics

• 0x4eb5e0 GetSystemMenu

• 0x4eb5e4 GetSysColorBrush

• 0x4eb5e8 GetSysColor

• 0x4eb5ec GetSubMenu

• 0x4eb5f0 GetScrollRange

• 0x4eb5f4 GetScrollPos

• 0x4eb5f8 GetScrollInfo

• 0x4eb5fc GetPropA

• 0x4eb600 GetParent

• 0x4eb604 GetWindow

• 0x4eb608 GetMenuStringA

• 0x4eb60c GetMenuState

• 0x4eb610 GetMenuItemInfoA

• 0x4eb614 GetMenuItemID

• 0x4eb618 GetMenuItemCount

• 0x4eb61c GetMenu

• 0x4eb620 GetLastActivePopup

• 0x4eb624 GetKeyboardState

• 0x4eb628 GetKeyboardLayoutList

• 0x4eb62c GetKeyboardLayout

• 0x4eb630 GetKeyState

• 0x4eb634 GetKeyNameTextA

• 0x4eb638 GetIconInfo

• 0x4eb63c GetForegroundWindow

• 0x4eb640 GetFocus

• 0x4eb644 GetDlgItem

• 0x4eb648 GetDesktopWindow

• 0x4eb64c GetDCEx

• 0x4eb650 GetDC

• 0x4eb654 GetCursorPos

• 0x4eb658 GetCursor

• 0x4eb65c GetClipboardData

• 0x4eb660 GetClientRect

• 0x4eb664 GetClassNameA

• 0x4eb668 GetClassInfoA

• 0x4eb66c GetCapture

• 0x4eb670 GetActiveWindow

• 0x4eb674 FrameRect

• 0x4eb678 FindWindowA

• 0x4eb67c FillRect

• 0x4eb680 EqualRect

• 0x4eb684 EnumWindows

• 0x4eb688 EnumThreadWindows

• 0x4eb68c EnumClipboardFormats

• 0x4eb690 EndPaint

• 0x4eb694 EnableWindow

• 0x4eb698 EnableScrollBar

• 0x4eb69c EnableMenuItem

• 0x4eb6a0 EmptyClipboard

• 0x4eb6a4 DrawTextA

• 0x4eb6a8 DrawMenuBar

• 0x4eb6ac DrawIconEx

• 0x4eb6b0 DrawIcon

• 0x4eb6b4 DrawFrameControl

• 0x4eb6b8 DrawFocusRect

• 0x4eb6bc DrawEdge

• 0x4eb6c0 DispatchMessageA

• 0x4eb6c4 DestroyWindow

• 0x4eb6c8 DestroyMenu

• 0x4eb6cc DestroyIcon

• 0x4eb6d0 DestroyCursor

• 0x4eb6d4 DeleteMenu

• 0x4eb6d8 DefWindowProcA

• 0x4eb6dc DefMDIChildProcA

• 0x4eb6e0 DefFrameProcA

• 0x4eb6e4 CreatePopupMenu

• 0x4eb6e8 CreateMenu

• 0x4eb6ec CreateIcon

• 0x4eb6f0 CloseClipboard

• 0x4eb6f4 ClientToScreen

• 0x4eb6f8 CheckMenuItem

• 0x4eb6fc CallWindowProcA

• 0x4eb700 CallNextHookEx

• 0x4eb704 BeginPaint

• 0x4eb708 CharNextA

• 0x4eb70c CharLowerBuffA

• 0x4eb710 CharLowerA

• 0x4eb714 CharUpperBuffA

• 0x4eb718 CharToOemA

• 0x4eb71c AdjustWindowRectEx

• 0x4eb720 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4eb728 Sleep

Library oleaut32.dll:

• 0x4eb730 SafeArrayPtrOfIndex

• 0x4eb734 SafeArrayPutElement

• 0x4eb738 SafeArrayGetElement

• 0x4eb73c SafeArrayUnaccessData

• 0x4eb740 SafeArrayAccessData

• 0x4eb744 SafeArrayGetUBound

• 0x4eb748 SafeArrayGetLBound

• 0x4eb74c SafeArrayCreate

• 0x4eb750 VariantChangeType

• 0x4eb754 VariantCopyInd

• 0x4eb758 VariantCopy

• 0x4eb75c VariantClear

• 0x4eb760 VariantInit

Library ole32.dll:

• 0x4eb768 CoUninitialize

• 0x4eb76c CoInitialize

Library oleaut32.dll:

• 0x4eb774 GetErrorInfo

• 0x4eb778 SysFreeString

Library comctl32.dll:

• 0x4eb780 ImageList_SetIconSize

• 0x4eb784 ImageList_GetIconSize

• 0x4eb788 ImageList_Write

• 0x4eb78c ImageList_Read

• 0x4eb790 ImageList_GetDragImage

• 0x4eb794 ImageList_DragShowNolock

• 0x4eb798 ImageList_SetDragCursorImage

• 0x4eb79c ImageList_DragMove

• 0x4eb7a0 ImageList_DragLeave

• 0x4eb7a4 ImageList_DragEnter

• 0x4eb7a8 ImageList_EndDrag

• 0x4eb7ac ImageList_BeginDrag

• 0x4eb7b0 ImageList_Remove

• 0x4eb7b4 ImageList_DrawEx

• 0x4eb7b8 ImageList_Draw

• 0x4eb7bc ImageList_GetBkColor

• 0x4eb7c0 ImageList_SetBkColor

• 0x4eb7c4 ImageList_ReplaceIcon

• 0x4eb7c8 ImageList_Add

• 0x4eb7cc ImageList_SetImageCount

• 0x4eb7d0 ImageList_GetImageCount

• 0x4eb7d4 ImageList_Destroy

• 0x4eb7d8 ImageList_Create

Library comdlg32.dll:

• 0x4eb7e0 GetSaveFileNameA

• 0x4eb7e4 GetOpenFileNameA

Library advapi32.dll:

• 0x4eb7ec QueryServiceStatus

• 0x4eb7f0 OpenServiceA

• 0x4eb7f4 OpenSCManagerA

• 0x4eb7f8 CloseServiceHandle

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	216.58.200.238
drive.google.com	A 31.13.78.65	162.125.2.6
www.microsoft.com	CNAME www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net CNAME e13678.ca2.s.tl88.net CNAME www.microsoft.com-c-3.edgekey.net A 27.148.139.88	27.148.139.88
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	57236	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	60221	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.

section	CODE
section	DATA
section	BSS

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443