2.8
中危
该样本未表现出任何异常！
重新分析
更多

8ddd6a5e068a27b5f09f0ad6aa6073312c1d2bffbc02a4a5ac9c7859138dff73

6dd852c87226336e4a10f10829407da9.exe

分析耗时

88s

最近分析

文件大小

461.9KB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1620796141.150999
GetComputerNameW
computer_name:
failed 0 0
1620796141.150999
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
This executable is signed
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (3 个事件)
Time & API Arguments Status Return Repeated
1620796135.838999
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 163840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x021a0000
success 0 0
1620796137.900999
NtAllocateVirtualMemory
process_identifier: 2760
region_size: 159744
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
base_address: 0x021d0000
success 0 0
1620796137.900999
NtProtectVirtualMemory
process_identifier: 2760
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 73728
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-06-05 00:49:55

Imports

Library KERNEL32.dll:
• 0x470b60 CloseHandle
• 0x470b64 lstrcpyA
• 0x470b68 lstrcatA
• 0x470b6c lstrlenA
• 0x470b70 GetModuleFileNameA
• 0x470b7c SearchPathA
• 0x470b80 GetFileAttributesA
• 0x470b84 GetLastError
• 0x470b88 CopyFileA
• 0x470b8c GetFileSize
• 0x470b90 LoadLibraryA
• 0x470b94 lstrcmpA
• 0x470b98 lstrcpynA
• 0x470b9c DeleteFileA
• 0x470ba0 TerminateProcess
• 0x470ba4 WaitForSingleObject
• 0x470ba8 GetExitCodeProcess
• 0x470bac CreateProcessA
• 0x470bb0 GetVersionExA
• 0x470bb4 GetModuleHandleA
• 0x470bb8 GetStartupInfoA
• 0x470bbc CreateFileA
• 0x470bc0 GetShortPathNameA
• 0x470bc4 GetTempFileNameA
• 0x470bc8 GetTempPathA
• 0x470bcc CreateDirectoryA
• 0x470bd0 GetProcAddress
• 0x470bd4 FreeLibrary
• 0x470bdc MoveFileExA
• 0x470be4 IsDebuggerPresent
• 0x470bec HeapDestroy
• 0x470bf0 SetFileTime
• 0x470bf4 _llseek
• 0x470bfc CreateHardLinkA
• 0x470c00 WriteProcessMemory
• 0x470c08 QueueUserAPC
• 0x470c0c GetOEMCP
• 0x470c10 HeapCreate
• 0x470c14 MoveFileA
• 0x470c1c SetWaitableTimer
• 0x470c24 Sleep
• 0x470c28 SetFilePointerEx
• 0x470c2c Process32Next
• 0x470c30 SetConsoleMode
• 0x470c34 VirtualAlloc
Library USER32.dll:
• 0x470c3c wsprintfA
• 0x470c40 MessageBoxA
• 0x470c44 LoadIconA
• 0x470c48 GetSystemMetrics
• 0x470c4c EnableWindow
• 0x470c50 IsIconic
• 0x470c54 GetClientRect
• 0x470c58 SendMessageA
• 0x470c5c DrawIcon
• 0x470c60 PackDDElParam
• 0x470c64 OpenIcon
• 0x470c68 OemToCharW
• 0x470c6c EditWndProc
• 0x470c70 CallWindowProcA
• 0x470c74 IntersectRect
• 0x470c78 EnumWindowStationsA
• 0x470c7c ToUnicode
• 0x470c80 EnumPropsW
• 0x470c84 LoadIconW
• 0x470c88 GetThreadDesktop
• 0x470c8c GetDialogBaseUnits
• 0x470c90 LoadCursorFromFileA
• 0x470c94 CharUpperW
• 0x470c98 DestroyCursor
• 0x470c9c VkKeyScanA
• 0x470ca0 DestroyMenu
• 0x470ca4 CharUpperA
• 0x470ca8 DrawMenuBar
• 0x470cac LoadCursorFromFileW
• 0x470cb0 GetListBoxInfo
• 0x470cb4 GetMenuItemCount
• 0x470cb8 IsWindow
• 0x470cbc WindowFromDC
Library GDI32.dll:
• 0x470cc4 GetEnhMetaFileA
• 0x470cc8 CreateMetaFileA
• 0x470ccc SwapBuffers
• 0x470cd0 GetSystemPaletteUse
• 0x470cd4 FillPath
• 0x470cd8 GetMapMode
• 0x470cdc CloseMetaFile
• 0x470ce0 UpdateColors
• 0x470ce4 CancelDC
• 0x470ce8 GetTextAlign
• 0x470cec GetLayout
• 0x470cf0 RealizePalette
Library ADVAPI32.dll:
• 0x470cf8 RegSetValueExA
• 0x470cfc RegEnumKeyA
• 0x470d00 RegOpenKeyExA
• 0x470d04 RegCloseKey
• 0x470d08 RegQueryValueExA
• 0x470d0c RegCreateKeyExA
• 0x470d10 RegQueryValueExW
• 0x470d14 GetUserNameA
Library SHELL32.dll:
• 0x470d1c ShellExecuteExA
• 0x470d20 SHGetFolderPathA
• 0x470d28 ShellExecuteA
Library ole32.dll:
• 0x470d30 CoCreateInstance
• 0x470d34 CLSIDFromProgID

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
203.208.40.34 443 192.168.56.101 49189

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 57236 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53210 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.