3.4
中危
2 个模型检测该样本为恶意！
重新分析
更多

687c24ff7494d6494555258204d3990d71337f12bbae83e13c190ffbfeecf474

713a293ba00a1dcf63e24bf503cb59e3.exe

分析耗时

89s

最近分析

文件大小

1021.5KB
静态报毒 动态报毒 INFECTED
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20201027 6.0.6.653
Alibaba 20190527 0.3.0.5
Baidu 20190318 1.0.0.2
Avast 20201027 18.4.3895.0
Tencent 20201027 1.0.0.1
Kingsoft 20201027 2013.8.14.323
CrowdStrike 20190702 1.0
静态指标
The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)
section .itext
section .didata
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1620762798.859125
__exception__
stacktrace: 
TMethodImplementationIntercept+0x5b806 dbkFCallWrapperAddr-0xedde 713a293ba00a1dcf63e24bf503cb59e3+0xaf85e @ 0x4af85e
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1638004
registers.edi: 0
registers.eax: 1638004
registers.ebp: 1638084
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 7
exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x778eb727
success 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (4 个事件)
Time & API Arguments Status Return Repeated
1620762798.859125
NtProtectVirtualMemory
process_identifier: 1176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620762798.859125
NtProtectVirtualMemory
process_identifier: 1176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 745472
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00401000
success 0 0
1620762798.859125
NtProtectVirtualMemory
process_identifier: 1176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004c4000
success 0 0
1620762798.859125
NtProtectVirtualMemory
process_identifier: 1176
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 290816
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004c6000
success 0 0
File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 个事件)
Sangfor Malware
McAfee-GW-Edition BehavesLike.Win32.Infected.fm
网络通信
Communicates with host for which no DNS query was performed (3 个事件)
host 172.217.24.14
host 203.208.40.98
host 203.208.41.65
Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)
dead_host 172.217.24.14:443
dead_host 172.217.160.110:443
dead_host 172.217.160.78:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-21 13:56:23

Imports

Library kernel32.dll:
• 0x4c22e4 GetACP
• 0x4c22e8 GetExitCodeProcess
• 0x4c22ec LocalFree
• 0x4c22f0 CloseHandle
• 0x4c22f4 SizeofResource
• 0x4c22f8 VirtualProtect
• 0x4c22fc VirtualFree
• 0x4c2300 GetFullPathNameW
• 0x4c2304 ExitProcess
• 0x4c2308 HeapAlloc
• 0x4c230c GetCPInfoExW
• 0x4c2310 RtlUnwind
• 0x4c2314 GetCPInfo
• 0x4c2318 GetStdHandle
• 0x4c231c GetModuleHandleW
• 0x4c2320 FreeLibrary
• 0x4c2324 HeapDestroy
• 0x4c2328 ReadFile
• 0x4c232c CreateProcessW
• 0x4c2330 GetLastError
• 0x4c2334 GetModuleFileNameW
• 0x4c2338 SetLastError
• 0x4c233c FindResourceW
• 0x4c2340 CreateThread
• 0x4c2344 CompareStringW
• 0x4c2348 LoadLibraryA
• 0x4c234c ResetEvent
• 0x4c2350 GetVersion
• 0x4c2354 RaiseException
• 0x4c2358 FormatMessageW
• 0x4c235c SwitchToThread
• 0x4c2360 GetExitCodeThread
• 0x4c2364 GetCurrentThread
• 0x4c2368 LoadLibraryExW
• 0x4c236c LockResource
• 0x4c2370 GetCurrentThreadId
• 0x4c2378 VirtualQuery
• 0x4c237c VirtualQueryEx
• 0x4c2380 Sleep
• 0x4c2388 SetFilePointer
• 0x4c238c LoadResource
• 0x4c2390 SuspendThread
• 0x4c2394 GetTickCount
• 0x4c2398 GetFileSize
• 0x4c239c GetStartupInfoW
• 0x4c23a0 GetFileAttributesW
• 0x4c23a8 GetThreadPriority
• 0x4c23ac SetThreadPriority
• 0x4c23b0 GetCurrentProcess
• 0x4c23b4 VirtualAlloc
• 0x4c23b8 GetSystemInfo
• 0x4c23bc GetCommandLineW
• 0x4c23c4 GetProcAddress
• 0x4c23c8 ResumeThread
• 0x4c23cc GetVersionExW
• 0x4c23d0 VerifyVersionInfoW
• 0x4c23d4 HeapCreate
• 0x4c23dc VerSetConditionMask
• 0x4c23e0 GetDiskFreeSpaceW
• 0x4c23e4 FindFirstFileW
• 0x4c23ec lstrlenW
• 0x4c23f4 SetEndOfFile
• 0x4c23f8 HeapFree
• 0x4c23fc WideCharToMultiByte
• 0x4c2400 FindClose
• 0x4c2404 MultiByteToWideChar
• 0x4c2408 LoadLibraryW
• 0x4c240c SetEvent
• 0x4c2410 CreateFileW
• 0x4c2414 GetLocaleInfoW
• 0x4c2418 GetSystemDirectoryW
• 0x4c241c DeleteFileW
• 0x4c2420 GetLocalTime
• 0x4c2428 WaitForSingleObject
• 0x4c242c WriteFile
• 0x4c2430 ExitThread
• 0x4c2438 TlsGetValue
• 0x4c243c GetDateFormatW
• 0x4c2440 SetErrorMode
• 0x4c2444 IsValidLocale
• 0x4c2448 TlsSetValue
• 0x4c244c CreateDirectoryW
• 0x4c2454 EnumCalendarInfoW
• 0x4c2458 LocalAlloc
• 0x4c2460 RemoveDirectoryW
• 0x4c2464 CreateEventW
• 0x4c2468 SetThreadLocale
• 0x4c246c GetThreadLocale
Library comctl32.dll:
• 0x4c2474 InitCommonControls
Library version.dll:
• 0x4c2480 VerQueryValueW
• 0x4c2484 GetFileVersionInfoW
Library user32.dll:
• 0x4c248c CreateWindowExW
• 0x4c2490 TranslateMessage
• 0x4c2494 CharLowerBuffW
• 0x4c2498 CallWindowProcW
• 0x4c249c CharUpperW
• 0x4c24a0 PeekMessageW
• 0x4c24a4 GetSystemMetrics
• 0x4c24a8 SetWindowLongW
• 0x4c24ac MessageBoxW
• 0x4c24b0 DestroyWindow
• 0x4c24b4 CharUpperBuffW
• 0x4c24b8 CharNextW
• 0x4c24c0 LoadStringW
• 0x4c24c4 ExitWindowsEx
• 0x4c24c8 DispatchMessageW
Library oleaut32.dll:
• 0x4c24d0 SysAllocStringLen
• 0x4c24d4 SafeArrayPtrOfIndex
• 0x4c24d8 VariantCopy
• 0x4c24dc SafeArrayGetLBound
• 0x4c24e0 SafeArrayGetUBound
• 0x4c24e4 VariantInit
• 0x4c24e8 VariantClear
• 0x4c24ec SysFreeString
• 0x4c24f0 SysReAllocStringLen
• 0x4c24f4 VariantChangeType
• 0x4c24f8 SafeArrayCreate
Library netapi32.dll:
• 0x4c2500 NetWkstaGetInfo
• 0x4c2504 NetApiBufferFree
Library advapi32.dll:
• 0x4c250c RegQueryValueExW
• 0x4c2518 RegCloseKey
• 0x4c251c OpenProcessToken
• 0x4c2520 RegOpenKeyExW

Exports

Ordinal Address Name
3 0x454058 TMethodImplementationIntercept
2 0x40d0a0 __dbk_fcall_wrapper
1 0x4be63c dbkFCallWrapperAddr

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51963 114.114.114.114 53
192.168.56.101 53210 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 50002 224.0.0.252 5355
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 53380 224.0.0.252 5355
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57756 224.0.0.252 5355
192.168.56.101 57874 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60384 224.0.0.252 5355
192.168.56.101 61680 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.