SmartHawk

7.8

高危

该样本未表现出任何异常！

重新分析

下载样本

407d9331fbbe4377cd69ea4bc27535e5a24a788d9cf476be4c7a6491d0860ebe

67eee01fabf6005fdce8983d3647bb47.exe

分析耗时

112s

最近分析

文件大小

273.0KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Queries for the computername (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619647015.695 GetComputerNameA	computer_name: OSKAR-PC	success	1	0

Uses Windows APIs to generate a cryptographic key (4 个事件)

Time & API	Arguments	Status	Return
1619647003.414 CryptGenKey	crypto_handle: 0x005e8128 algorithm_identifier: 0x0000660e () provider_handle: 0x005e7778 flags: 1 key: fHÇ¢¸FBVVLÜþ¬	success	1
1619647015.695 CryptExportKey	crypto_handle: 0x005e8128 crypto_export_handle: 0x005e7840 buffer: f¤ ÎØæþgò%3¡ÀñÍ¥ú0©Ù%@û»ÝW£íê{Æ)ÅµËv»;1Xô¡3c"±üê[çÅD1ú,j6¸t¯;ºÎk°Hö5c á blob_type: 1 flags: 64	success	1
1619647046.617 CryptExportKey	crypto_handle: 0x005e8128 crypto_export_handle: 0x005e7840 buffer: f¤Å*èÌ±£¯&úR{ùõ8F¾JP[PÐS<FÆðî;DÏ 8ß¤{ <¢ `î¯©o T÷ r¢¬c Å^cÆL÷ÇCí«<me nÅbV¿À blob_type: 1 flags: 64	success	1
1619647070.164 CryptExportKey	crypto_handle: 0x005e8128 crypto_export_handle: 0x005e7840 buffer: f¤åj²ØyïT4 @¶øÿ7g°5Nég_ìéº¾QVÏÜåC¿ËJ·:Ñ§Íè= =ÛÎ2·©Í:BB¢m¹T$zÍþovr[Ù*"8<ìW®zí¢Dû§ blob_type: 1 flags: 64	success	1

Allocates read-write-execute memory (usually to unpack itself) (3 个事件)

Time & API	Arguments	Status
1619610660.483625 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x007a0000	success
1619610289.847271 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004160000	success
1619647002.898 NtAllocateVirtualMemory	process_identifier: 2996 region_size: 36864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 12289 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x00510000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Moves the original executable to a new location (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610661.983625 MoveFileWithProgressW	oldfilepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\67eee01fabf6005fdce8983d3647bb47.exe newfilepath: C:\Windows\SysWOW64\sti\bidispl.exe newfilepath_r: C:\Windows\SysWOW64\sti\bidispl.exe flags: 3 oldfilepath_r: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\67eee01fabf6005fdce8983d3647bb47.exe	success	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619647020.305 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (1 个事件)

entropy

7.112349710547305

section

{'size_of_data': '0x0000d000', 'virtual_address': '0x0003c000', 'entropy': 7.112349710547305, 'name': '.rsrc', 'virtual_size': '0x0000cef8'}

description

A section with a high entropy has been found

Expresses interest in specific running processes (1 个事件)

process

bidispl.exe

Reads the systems User Agent and subsequently performs requests (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619647018.226 InternetOpenW	proxy_bypass: access_type: 0 proxy_name: flags: 0 user_agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)	success	13369348	0

Communicates with host for which no DNS query was performed (4 个事件)

host	180.163.150.162
host	104.247.221.104
host	177.144.135.2
host	201.213.32.59

Installs itself for autorun at Windows startup (1 个事件)

service_name

bidispl

service_path

C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\sti\bidispl.exe"

Created a service where a service was also not started (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619610665.983625 CreateServiceW	service_start_name: start_type: 2 service_handle: 0x02a4ac90 display_name: bidispl error_control: 0 service_name: bidispl filepath: C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\"C:\Windows\SysWOW64\sti\bidispl.exe" filepath_r: "C:\Windows\SysWOW64\sti\bidispl.exe" service_manager_handle: 0x02a62c38 desired_access: 2 service_type: 16 password:	success	44346512	0

Sets or modifies WPAD proxy autoconfiguration file for traffic interception (8 个事件)

Time & API	Arguments	Status
1619647022.867 RegSetValueExA	key_handle: 0x000003a8 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionReason	success
1619647022.867 RegSetValueExA	key_handle: 0x000003a8 value: ÅäW<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecisionTime	success
1619647022.867 RegSetValueExA	key_handle: 0x000003a8 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadDecision	success
1619647022.867 RegSetValueExW	key_handle: 0x000003a8 value: 网络 2 regkey_r: WpadNetworkName reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{40112ABE-63B3-43C3-BE93-1440EE3AF106}\WpadNetworkName	success
1619647022.867 RegSetValueExA	key_handle: 0x000003c0 value: 1 regkey_r: WpadDecisionReason reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionReason	success
1619647022.867 RegSetValueExA	key_handle: 0x000003c0 value: ÅäW<× regkey_r: WpadDecisionTime reg_type: 3 (REG_BINARY) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecisionTime	success
1619647022.867 RegSetValueExA	key_handle: 0x000003c0 value: 3 regkey_r: WpadDecision reg_type: 4 (REG_DWORD) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-00-27-00-00-00\WpadDecision	success
1619647022.883 RegSetValueExW	key_handle: 0x000003a4 value: {40112ABE-63B3-43C3-BE93-1440EE3AF106} regkey_r: WpadLastNetwork reg_type: 1 (REG_SZ) regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadLastNetwork	success

Attempts to remove evidence of file being downloaded from the Internet (1 个事件)

file	C:\Windows\SysWOW64\sti\bidispl.exe:Zone.Identifier

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (4 个事件)

dead_host	172.217.24.14:443
dead_host	104.247.221.104:443
dead_host	177.144.135.2:80
dead_host	201.213.32.59:80

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-07-18 02:34:43

Imports

Library KERNEL32.dll:

• 0x42a0d0 VirtualAlloc

• 0x42a0d4 HeapReAlloc

• 0x42a0d8 Sleep

• 0x42a0dc ExitProcess

• 0x42a0e0 HeapSize

• 0x42a0e4 TerminateProcess

• 0x42a0e8 UnhandledExceptionFilter

• 0x42a0ec SetUnhandledExceptionFilter

• 0x42a0f0 IsDebuggerPresent

• 0x42a0f4 GetStdHandle

• 0x42a0f8 FreeEnvironmentStringsA

• 0x42a0fc GetEnvironmentStrings

• 0x42a100 FreeEnvironmentStringsW

• 0x42a104 GetEnvironmentStringsW

• 0x42a108 SetHandleCount

• 0x42a10c GetFileType

• 0x42a110 HeapCreate

• 0x42a114 VirtualFree

• 0x42a118 QueryPerformanceCounter

• 0x42a11c HeapFree

• 0x42a120 GetSystemTimeAsFileTime

• 0x42a124 GetACP

• 0x42a128 IsValidCodePage

• 0x42a12c InitializeCriticalSectionAndSpinCount

• 0x42a130 GetConsoleCP

• 0x42a134 GetConsoleMode

• 0x42a138 LCMapStringA

• 0x42a13c LCMapStringW

• 0x42a140 GetStringTypeA

• 0x42a144 GetStringTypeW

• 0x42a148 SetStdHandle

• 0x42a14c WriteConsoleA

• 0x42a150 GetConsoleOutputCP

• 0x42a154 WriteConsoleW

• 0x42a158 HeapAlloc

• 0x42a15c GetStartupInfoA

• 0x42a160 GetCommandLineA

• 0x42a164 RaiseException

• 0x42a168 RtlUnwind

• 0x42a16c SetErrorMode

• 0x42a170 CreateFileA

• 0x42a174 FlushFileBuffers

• 0x42a178 SetFilePointer

• 0x42a17c WriteFile

• 0x42a180 ReadFile

• 0x42a184 WritePrivateProfileStringA

• 0x42a188 GetOEMCP

• 0x42a18c GetCPInfo

• 0x42a190 GlobalFlags

• 0x42a194 TlsFree

• 0x42a198 DeleteCriticalSection

• 0x42a19c LocalReAlloc

• 0x42a1a0 TlsSetValue

• 0x42a1a4 TlsAlloc

• 0x42a1a8 InitializeCriticalSection

• 0x42a1ac GlobalHandle

• 0x42a1b0 GlobalReAlloc

• 0x42a1b4 EnterCriticalSection

• 0x42a1b8 TlsGetValue

• 0x42a1bc LeaveCriticalSection

• 0x42a1c0 LocalAlloc

• 0x42a1c4 InterlockedIncrement

• 0x42a1c8 GetModuleHandleW

• 0x42a1cc CloseHandle

• 0x42a1d0 GetCurrentThread

• 0x42a1d4 ConvertDefaultLocale

• 0x42a1d8 EnumResourceLanguagesA

• 0x42a1dc GetLocaleInfoA

• 0x42a1e0 InterlockedExchange

• 0x42a1e4 lstrcmpA

• 0x42a1e8 InterlockedDecrement

• 0x42a1ec GetModuleFileNameW

• 0x42a1f0 GetCurrentProcessId

• 0x42a1f4 GetModuleFileNameA

• 0x42a1f8 FreeResource

• 0x42a1fc GetCurrentThreadId

• 0x42a200 GlobalGetAtomNameA

• 0x42a204 GlobalAddAtomA

• 0x42a208 GlobalFindAtomA

• 0x42a20c GlobalDeleteAtom

• 0x42a210 FreeLibrary

• 0x42a214 CompareStringA

• 0x42a218 LoadLibraryA

• 0x42a21c lstrcmpW

• 0x42a220 GetModuleHandleA

• 0x42a224 GetVersionExA

• 0x42a228 GetLastError

• 0x42a22c SetLastError

• 0x42a230 GlobalFree

• 0x42a234 GlobalAlloc

• 0x42a238 GlobalLock

• 0x42a23c GlobalUnlock

• 0x42a240 FormatMessageA

• 0x42a244 LocalFree

• 0x42a248 MultiByteToWideChar

• 0x42a24c MulDiv

• 0x42a250 lstrlenA

• 0x42a254 LoadLibraryExA

• 0x42a258 GetProcAddress

• 0x42a25c GetCurrentProcess

• 0x42a260 WideCharToMultiByte

• 0x42a264 FindResourceA

• 0x42a268 LoadResource

• 0x42a26c LockResource

• 0x42a270 GetTickCount

• 0x42a274 SizeofResource

Library USER32.dll:

• 0x42a298 UnregisterClassA

• 0x42a29c GetSysColorBrush

• 0x42a2a0 DestroyMenu

• 0x42a2a4 SetCursor

• 0x42a2a8 GetMessageA

• 0x42a2ac TranslateMessage

• 0x42a2b0 ValidateRect

• 0x42a2b4 PostQuitMessage

• 0x42a2b8 GetCursorPos

• 0x42a2bc WindowFromPoint

• 0x42a2c0 GetDesktopWindow

• 0x42a2c4 GetActiveWindow

• 0x42a2c8 CreateDialogIndirectParamA

• 0x42a2cc GetNextDlgTabItem

• 0x42a2d0 EndDialog

• 0x42a2d4 GetWindowThreadProcessId

• 0x42a2d8 EndPaint

• 0x42a2dc BeginPaint

• 0x42a2e0 ReleaseDC

• 0x42a2e4 GetDC

• 0x42a2e8 ClientToScreen

• 0x42a2ec GrayStringA

• 0x42a2f0 DrawTextExA

• 0x42a2f4 DrawTextA

• 0x42a2f8 TabbedTextOutA

• 0x42a2fc IsWindowEnabled

• 0x42a300 ShowWindow

• 0x42a304 MoveWindow

• 0x42a308 SetWindowTextA

• 0x42a30c IsDialogMessageA

• 0x42a310 SetMenuItemBitmaps

• 0x42a314 GetMenuCheckMarkDimensions

• 0x42a318 LoadBitmapA

• 0x42a31c ModifyMenuA

• 0x42a320 EnableMenuItem

• 0x42a324 CheckMenuItem

• 0x42a328 RegisterWindowMessageA

• 0x42a32c GetCapture

• 0x42a330 SetWindowsHookExA

• 0x42a334 CallNextHookEx

• 0x42a338 GetClassLongA

• 0x42a33c GetClassNameA

• 0x42a340 SetPropA

• 0x42a344 GetPropA

• 0x42a348 RemovePropA

• 0x42a34c GetFocus

• 0x42a350 SetFocus

• 0x42a354 GetWindowTextLengthA

• 0x42a358 GetWindowTextA

• 0x42a35c GetForegroundWindow

• 0x42a360 GetLastActivePopup

• 0x42a364 SetActiveWindow

• 0x42a368 DispatchMessageA

• 0x42a36c GetDlgItem

• 0x42a370 GetTopWindow

• 0x42a374 DestroyWindow

• 0x42a378 UnhookWindowsHookEx

• 0x42a37c GetMessageTime

• 0x42a380 PeekMessageA

• 0x42a384 MapWindowPoints

• 0x42a388 GetKeyState

• 0x42a38c SetMenu

• 0x42a390 SetForegroundWindow

• 0x42a394 IsWindowVisible

• 0x42a398 UpdateWindow

• 0x42a39c PostMessageA

• 0x42a3a0 MessageBoxA

• 0x42a3a4 CreateWindowExA

• 0x42a3a8 GetClassInfoExA

• 0x42a3ac GetClassInfoA

• 0x42a3b0 AdjustWindowRectEx

• 0x42a3b4 CopyRect

• 0x42a3b8 SetRect

• 0x42a3bc InflateRect

• 0x42a3c0 OffsetRect

• 0x42a3c4 ScreenToClient

• 0x42a3c8 GetDlgCtrlID

• 0x42a3cc CallWindowProcA

• 0x42a3d0 GetMenu

• 0x42a3d4 GetWindowLongA

• 0x42a3d8 SetWindowLongA

• 0x42a3dc SetWindowPos

• 0x42a3e0 WinHelpA

• 0x42a3e4 DrawEdge

• 0x42a3e8 DrawFrameControl

• 0x42a3ec DrawFocusRect

• 0x42a3f0 SendMessageA

• 0x42a3f4 GetWindowRect

• 0x42a3f8 RedrawWindow

• 0x42a3fc GetParent

• 0x42a400 EnableWindow

• 0x42a404 IsWindow

• 0x42a408 GetSystemMetrics

• 0x42a40c GetSysColor

• 0x42a410 PtInRect

• 0x42a414 GetClientRect

• 0x42a418 InvalidateRect

• 0x42a41c SetCapture

• 0x42a420 SystemParametersInfoA

• 0x42a424 ReleaseCapture

• 0x42a428 GetMessagePos

• 0x42a42c RegisterClassA

• 0x42a430 LoadCursorA

• 0x42a434 GetWindowPlacement

• 0x42a438 GetWindow

• 0x42a43c GetMenuState

• 0x42a440 GetMenuItemID

• 0x42a444 GetMenuItemCount

• 0x42a448 GetSubMenu

• 0x42a44c LoadIconA

• 0x42a450 IsIconic

• 0x42a454 GetSystemMenu

• 0x42a458 AppendMenuA

• 0x42a45c DrawIcon

• 0x42a460 IsRectEmpty

• 0x42a464 DefWindowProcA

• 0x42a468 SendDlgItemMessageA

Library GDI32.dll:

• 0x42a028 TextOutA

• 0x42a02c ExtTextOutA

• 0x42a030 Escape

• 0x42a034 SetViewportOrgEx

• 0x42a038 OffsetViewportOrgEx

• 0x42a03c SetViewportExtEx

• 0x42a040 ScaleViewportExtEx

• 0x42a044 SetWindowExtEx

• 0x42a048 ScaleWindowExtEx

• 0x42a04c DeleteDC

• 0x42a050 RectVisible

• 0x42a054 SelectPalette

• 0x42a058 PtVisible

• 0x42a05c DeleteObject

• 0x42a060 Rectangle

• 0x42a064 MoveToEx

• 0x42a068 LineTo

• 0x42a06c SetMapMode

• 0x42a070 SetBkMode

• 0x42a074 RestoreDC

• 0x42a078 SaveDC

• 0x42a07c CreateBitmap

• 0x42a080 GetObjectA

• 0x42a084 SetBkColor

• 0x42a088 SetTextColor

• 0x42a08c GetClipBox

• 0x42a090 BitBlt

• 0x42a094 Pie

• 0x42a098 Ellipse

• 0x42a09c SelectObject

• 0x42a0a0 CreateCompatibleDC

• 0x42a0a4 CreateCompatibleBitmap

• 0x42a0a8 CreateFontA

• 0x42a0ac CreateSolidBrush

• 0x42a0b0 GetStockObject

• 0x42a0b4 GetTextExtentPoint32A

• 0x42a0b8 RealizePalette

• 0x42a0bc GetDeviceCaps

• 0x42a0c0 CreatePalette

• 0x42a0c4 CreateFontIndirectA

• 0x42a0c8 CreatePen

Library WINSPOOL.DRV:

• 0x42a470 DocumentPropertiesA

• 0x42a474 OpenPrinterA

• 0x42a478 ClosePrinter

Library ADVAPI32.dll:

• 0x42a000 RegSetValueExA

• 0x42a004 RegCreateKeyExA

• 0x42a008 RegQueryValueA

• 0x42a00c RegOpenKeyA

• 0x42a010 RegEnumKeyA

• 0x42a014 RegDeleteKeyA

• 0x42a018 RegOpenKeyExA

• 0x42a01c RegQueryValueExA

• 0x42a020 RegCloseKey

Library SHLWAPI.dll:

• 0x42a28c PathFindFileNameA

• 0x42a290 PathFindExtensionA

Library OLEAUT32.dll:

• 0x42a27c VariantClear

• 0x42a280 VariantChangeType

• 0x42a284 VariantInit

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	172.217.160.78
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	50568	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60221	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.