SmartHawk

5.6

高危

47 个模型检测该样本为恶意！

重新分析

下载样本

c4b40854b0d96e0967c64ee0f80d41222d57029ec9e3e4b72f4232291879caad

6e45d3fdb598634ad074e2006edb03bc.exe

分析耗时

78s

最近分析

文件大小

1.5MB

静态报毒动态报毒 AI SCORE=86 AIDETECTVM AIXF ARTEMIS BLADABINDI CONFIDENCE DBNN DOWNLOADER33 GAMEHACK GENERICKD HLFUNB KEYLOGGERX KRYPTIK MALICIOUS SFX MALWARE2 MALWARE@#20RM7PIT2HKAO MULTIPLE DETECTIONS OFCUJZGGGDM RUNNER SCORE STATIC AI SUSGEN TSCOPE UM3@AKWLGEEG UNSAFE ZEMSILF 更多

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀结果	查杀时间	查杀版本
CrowdStrike	win/malicious_confidence_90% (W)	20190702	1.0
Alibaba	Backdoor:MSIL/Kryptik.69ab3f49	20190527	0.3.0.5
Avast	Win32:KeyloggerX-gen [Trj]	20201210	21.1.5827.0
Baidu		20190318	1.0.0.2
McAfee	Artemis!6E45D3FDB598	20201211	6.0.6.653
Tencent		20201211	1.0.0.1

Queries for the computername (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619613461.250999 GetComputerNameA	computer_name: OSKAR-PC	success	1	0
1619613461.250999 GetComputerNameW	computer_name: OSKAR-PC	success	1	0

Checks if process is being debugged by a debugger (6 个事件)

Time & API	Arguments	Status	Return	Repeated
1619613458.375999 IsDebuggerPresent		failed	0	0
1619613458.375999 IsDebuggerPresent		failed	0	0
1619613461.203999 IsDebuggerPresent		failed	0	0
1619613461.219999 IsDebuggerPresent		failed	0	0
1619613458.376249 IsDebuggerPresent		failed	0	0
1619613458.376249 IsDebuggerPresent		failed	0	0

This executable has a PDB path (1 个事件)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619613458.453999 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.gfids

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

PNG

Allocates read-write-execute memory (usually to unpack itself) (50 out of 66 个事件)

Time & API	Arguments	Status
1619613457.797999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00650000	success
1619613457.797999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00780000	success
1619613458.141999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00650000	success
1619613458.172999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00740000	success
1619613458.219999 NtProtectVirtualMemory	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619613458.375999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x02200000	success
1619613458.375999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02330000	success
1619613458.375999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0055a000	success
1619613458.375999 NtProtectVirtualMemory	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619613458.375999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00552000	success
1619613458.781999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00562000	success
1619613458.938999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00595000	success
1619613458.938999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0059b000	success
1619613458.938999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00597000	success
1619613459.063999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00563000	success
1619613459.063999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00564000	success
1619613459.063999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00566000	success
1619613459.094999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0056c000	success
1619613459.875999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c0000	success
1619613459.922999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c2000	success
1619613460.109999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c3000	success
1619613460.156999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006d0000	success
1619613460.375999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0058a000	success
1619613460.375999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00587000	success
1619613460.563999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c4000	success
1619613460.594999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c5000	success
1619613460.703999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c6000	success
1619613460.734999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006c7000	success
1619613460.828999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00586000	success
1619613461.094999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 32768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x006d1000	success
1619613461.203999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02331000	success
1619613461.203999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02332000	success
1619613461.297999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02333000	success
1619613461.313999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02334000	success
1619613461.313999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 20480 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02338000	success
1619613461.313999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0233d000	success
1619613461.313999 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02341000	success
1619613457.970249 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 524288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x00400000	success
1619613457.970249 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00440000	success
1619613458.157249 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x01f40000	success
1619613458.157249 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x02090000	success
1619613458.220249 NtProtectVirtualMemory	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e71000	success
1619613458.360249 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 8192 (MEM_RESERVE) base_address: 0x020d0000	success
1619613458.376249 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x022c0000	success
1619613458.376249 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005aa000	success
1619613458.376249 NtProtectVirtualMemory	process_identifier: 2344 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x73e72000	success
1619613458.376249 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005a2000	success
1619613458.782249 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005b2000	success
1619613458.939249 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005d5000	success
1619613458.939249 NtAllocateVirtualMemory	process_identifier: 2344 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x005db000	success

Creates executable files on the filesystem (3 个事件)

file	C:\ProgramData\justpro-cc.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\b8b521c5-dcfc-45c7-addb-d6113e243b44\AgileDotNetRT.dll
file	C:\ProgramData\javaw.exe

Drops a binary and executes it (2 个事件)

file	C:\ProgramData\justpro-cc.exe
file	C:\ProgramData\javaw.exe

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\b8b521c5-dcfc-45c7-addb-d6113e243b44\AgileDotNetRT.dll

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.7843394581652054

section

{'size_of_data': '0x00021c00', 'virtual_address': '0x00062000', 'entropy': 7.7843394581652054, 'name': '.rsrc', 'virtual_size': '0x00021bdc'}

description

A section with a high entropy has been found

entropy

0.3524804177545692

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

The process javaw.exe wrote an executable file to disk (2 个事件)

file	C:\ProgramData\javaw.exe
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\b8b521c5-dcfc-45c7-addb-d6113e243b44\AgileDotNetRT.dll

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 个事件)

Bkav	W32.AIDetectVM.malware2
DrWeb	Trojan.DownLoader33.48893
MicroWorld-eScan	Trojan.GenericKD.43319907
FireEye	Generic.mg.6e45d3fdb598634a
ALYac	Trojan.GenericKD.43319907
Cylance	Unsafe
Sangfor	Malware
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	Backdoor:MSIL/Kryptik.69ab3f49
K7GW	Trojan ( 004eee6d1 )
K7AntiVirus	Trojan ( 004eee6d1 )
Arcabit	Trojan.Generic.D2950263
BitDefenderTheta	Gen:NN.ZemsilF.34670.um3@aKwlgeeG
Cyren	W32/Trojan.DBNN-4931
Symantec	Trojan.Gen.MBT
ESET-NOD32	multiple detections
APEX	Malicious
Avast	Win32:KeyloggerX-gen [Trj]
Kaspersky	HEUR:Backdoor.MSIL.Bladabindi.gen
BitDefender	Trojan.GenericKD.43319907
NANO-Antivirus	Trojan.Win32.GameHack.hlfunb
Paloalto	generic.ml
AegisLab	Trojan.MSIL.Bladabindi.m!c
Ad-Aware	Trojan.GenericKD.43319907
Emsisoft	Trojan.GenericKD.43319907 (B)
Comodo	Malware@#20rm7pit2hkao
F-Secure	Trojan.TR/AD.Bladabindi.aixf
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious SFX
Avira	TR/AD.Bladabindi.aixf
Microsoft	Backdoor:MSIL/Bladabindi
ZoneAlarm	HEUR:Backdoor.MSIL.Bladabindi.gen
GData	Trojan.GenericKD.43319907
Cynet	Malicious (score: 100)
McAfee	Artemis!6E45D3FDB598
MAX	malware (ai score=86)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Backdoor.Bladabindi
Yandex	Trojan.Kryptik!OfcuJzGGgDM
Ikarus	Trojan.BAT.Runner
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	MSIL/Kryptik.GBD!tr
AVG	Win32:KeyloggerX-gen [Trj]
Cybereason	malicious.5fb54a
Panda	Trj/CI.A
Qihoo-360	Generic/Backdoor.633

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-03-26 18:02:47

Imports

Library KERNEL32.dll:

• 0x432000 GetLastError

• 0x432004 SetLastError

• 0x432008 FormatMessageW

• 0x43200c GetCurrentProcess

• 0x432010 DeviceIoControl

• 0x432014 SetFileTime

• 0x432018 CloseHandle

• 0x43201c CreateDirectoryW

• 0x432020 RemoveDirectoryW

• 0x432024 CreateFileW

• 0x432028 DeleteFileW

• 0x43202c CreateHardLinkW

• 0x432030 GetShortPathNameW

• 0x432034 GetLongPathNameW

• 0x432038 MoveFileW

• 0x43203c GetFileType

• 0x432040 GetStdHandle

• 0x432044 WriteFile

• 0x432048 ReadFile

• 0x43204c FlushFileBuffers

• 0x432050 SetEndOfFile

• 0x432054 SetFilePointer

• 0x432058 SetFileAttributesW

• 0x43205c GetFileAttributesW

• 0x432060 FindClose

• 0x432064 FindFirstFileW

• 0x432068 FindNextFileW

• 0x43206c GetVersionExW

• 0x432070 GetCurrentDirectoryW

• 0x432074 GetFullPathNameW

• 0x432078 FoldStringW

• 0x43207c GetModuleFileNameW

• 0x432080 GetModuleHandleW

• 0x432084 FindResourceW

• 0x432088 FreeLibrary

• 0x43208c GetProcAddress

• 0x432090 GetCurrentProcessId

• 0x432094 ExitProcess

• 0x432098 SetThreadExecutionState

• 0x43209c Sleep

• 0x4320a0 LoadLibraryW

• 0x4320a4 GetSystemDirectoryW

• 0x4320a8 CompareStringW

• 0x4320ac AllocConsole

• 0x4320b0 FreeConsole

• 0x4320b4 AttachConsole

• 0x4320b8 WriteConsoleW

• 0x4320bc GetProcessAffinityMask

• 0x4320c0 CreateThread

• 0x4320c4 SetThreadPriority

• 0x4320c8 InitializeCriticalSection

• 0x4320cc EnterCriticalSection

• 0x4320d0 LeaveCriticalSection

• 0x4320d4 DeleteCriticalSection

• 0x4320d8 SetEvent

• 0x4320dc ResetEvent

• 0x4320e0 ReleaseSemaphore

• 0x4320e4 WaitForSingleObject

• 0x4320e8 CreateEventW

• 0x4320ec CreateSemaphoreW

• 0x4320f0 GetSystemTime

• 0x4320f4 SystemTimeToTzSpecificLocalTime

• 0x4320f8 TzSpecificLocalTimeToSystemTime

• 0x4320fc SystemTimeToFileTime

• 0x432100 FileTimeToLocalFileTime

• 0x432104 LocalFileTimeToFileTime

• 0x432108 FileTimeToSystemTime

• 0x43210c GetCPInfo

• 0x432110 IsDBCSLeadByte

• 0x432114 MultiByteToWideChar

• 0x432118 WideCharToMultiByte

• 0x43211c GlobalAlloc

• 0x432120 LockResource

• 0x432124 GlobalLock

• 0x432128 GlobalUnlock

• 0x43212c GlobalFree

• 0x432130 LoadResource

• 0x432134 SizeofResource

• 0x432138 SetCurrentDirectoryW

• 0x43213c GetExitCodeProcess

• 0x432140 GetLocalTime

• 0x432144 GetTickCount

• 0x432148 MapViewOfFile

• 0x43214c UnmapViewOfFile

• 0x432150 CreateFileMappingW

• 0x432154 OpenFileMappingW

• 0x432158 GetCommandLineW

• 0x43215c SetEnvironmentVariableW

• 0x432160 ExpandEnvironmentStringsW

• 0x432164 GetTempPathW

• 0x432168 MoveFileExW

• 0x43216c GetLocaleInfoW

• 0x432170 GetTimeFormatW

• 0x432174 GetDateFormatW

• 0x432178 GetNumberFormatW

• 0x43217c SetFilePointerEx

• 0x432180 GetConsoleMode

• 0x432184 GetConsoleCP

• 0x432188 HeapSize

• 0x43218c SetStdHandle

• 0x432190 GetProcessHeap

• 0x432194 RaiseException

• 0x432198 GetSystemInfo

• 0x43219c VirtualProtect

• 0x4321a0 VirtualQuery

• 0x4321a4 LoadLibraryExA

• 0x4321a8 IsProcessorFeaturePresent

• 0x4321ac IsDebuggerPresent

• 0x4321b0 UnhandledExceptionFilter

• 0x4321b4 SetUnhandledExceptionFilter

• 0x4321b8 GetStartupInfoW

• 0x4321bc QueryPerformanceCounter

• 0x4321c0 GetCurrentThreadId

• 0x4321c4 GetSystemTimeAsFileTime

• 0x4321c8 InitializeSListHead

• 0x4321cc TerminateProcess

• 0x4321d0 RtlUnwind

• 0x4321d4 EncodePointer

• 0x4321d8 InitializeCriticalSectionAndSpinCount

• 0x4321dc TlsAlloc

• 0x4321e0 TlsGetValue

• 0x4321e4 TlsSetValue

• 0x4321e8 TlsFree

• 0x4321ec LoadLibraryExW

• 0x4321f0 QueryPerformanceFrequency

• 0x4321f4 GetModuleHandleExW

• 0x4321f8 GetModuleFileNameA

• 0x4321fc GetACP

• 0x432200 HeapFree

• 0x432204 HeapAlloc

• 0x432208 HeapReAlloc

• 0x43220c GetStringTypeW

• 0x432210 LCMapStringW

• 0x432214 FindFirstFileExA

• 0x432218 FindNextFileA

• 0x43221c IsValidCodePage

• 0x432220 GetOEMCP

• 0x432224 GetCommandLineA

• 0x432228 GetEnvironmentStringsW

• 0x43222c FreeEnvironmentStringsW

• 0x432230 DecodePointer

Library gdiplus.dll:

• 0x432238 GdiplusShutdown

• 0x43223c GdiplusStartup

• 0x432240 GdipCreateHBITMAPFromBitmap

• 0x432244 GdipCreateBitmapFromStreamICM

• 0x432248 GdipCreateBitmapFromStream

• 0x43224c GdipDisposeImage

• 0x432250 GdipCloneImage

• 0x432254 GdipFree

• 0x432258 GdipAlloc

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	50537	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702
192.168.56.101	62192	239.255.255.250	3702
192.168.56.101	50534	8.8.8.8	53
192.168.56.101	51963	8.8.8.8	53

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.