SmartHawk

1.4

低危

1 个模型检测该样本为恶意！

重新分析

下载样本

70490e3b269206a5212168bd4fd1421937a136b67a495277e3834eae2c5c19dd

718a64778e430730a0bd744ac5573652.exe

分析耗时

27s

最近分析

文件大小

78.0KB

静态报毒动态报毒 100% SCORE UNSAFE

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀时间	查杀版本
McAfee	20201007	6.0.6.653
Alibaba	20190527	0.3.0.5
Baidu	20190318	1.0.0.2
Kingsoft	20201007	2013.8.14.323
CrowdStrike	20190702	1.0

Command line console output was observed (14 个事件)

Time & API	Arguments	Status	Return
1620766688.922125 WriteConsoleA	buffer: Pelles Library Manager, Version 7.00.0 console_handle: 0x00000013	success	1
1620766688.922125 WriteConsoleA	buffer: Copyright (c) Pelle Orinius 1997-2012 console_handle: 0x00000013	success	1
1620766688.937125 WriteConsoleA	buffer: Syntax: POLIB [ { option \| file \| @commandfile } ... ] console_handle: 0x00000013	success	1
1620766688.937125 WriteConsoleA	buffer: Options: console_handle: 0x00000013	success	1
1620766688.937125 WriteConsoleA	buffer: /DEF:filename Build import library from module-definition file console_handle: 0x00000013	success	1
1620766688.937125 WriteConsoleA	buffer: /EXPLODE Create object files for all members console_handle: 0x00000013	success	1
1620766688.937125 WriteConsoleA	buffer: /EXTRACT:member Create object file for the given member console_handle: 0x00000013	success	1
1620766688.937125 WriteConsoleA	buffer: /LIST List all member names console_handle: 0x00000013	success	1
1620766688.937125 WriteConsoleA	buffer: /MACHINE:type Set target machine type: AMD64, ARM, X64, or X86 console_handle: 0x00000013	success	1
1620766688.937125 WriteConsoleA	buffer: /MAKEDEF:filename Build module-definition file from import library console_handle: 0x00000013	success	1
1620766688.937125 WriteConsoleA	buffer: /NOUND Don't add underscore to import names console_handle: 0x00000013	success	1
1620766688.937125 WriteConsoleA	buffer: /OUT:filename Name the output file console_handle: 0x00000013	success	1
1620766688.937125 WriteConsoleA	buffer: /REMOVE:member Remove the given member console_handle: 0x00000013	success	1
1620766688.937125 WriteConsoleA	buffer: /VERBOSE Display more information console_handle: 0x00000013	success	1

The executable uses a known packer (1 个事件)

packer

Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)

File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)

eGambit

Unsafe.AI_Score_100%

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2012-09-23 09:32:21

Imports

Library KERNEL32.dll:

• 0x412b38 GetCommandLineA

• 0x412b3c GetCurrentProcess

• 0x412b40 GetCurrentThread

• 0x412b44 DuplicateHandle

• 0x412b48 SetConsoleCtrlHandler

• 0x412b4c SetFileApisToOEM

• 0x412b50 GetTempPathA

• 0x412b54 GetTickCount

• 0x412b58 FormatMessageA

• 0x412b5c LocalAlloc

• 0x412b60 LocalFree

• 0x412b64 SuspendThread

• 0x412b68 CreateFileA

• 0x412b6c GetLastError

• 0x412b70 CreateFileMappingA

• 0x412b74 MapViewOfFile

• 0x412b78 GetSystemInfo

• 0x412b7c GetVersionExA

• 0x412b80 MapViewOfFileEx

• 0x412b84 Sleep

• 0x412b88 UnmapViewOfFile

• 0x412b8c CloseHandle

• 0x412b90 GetFileSize

• 0x412b94 SetFilePointer

• 0x412b98 SetEndOfFile

• 0x412b9c GetThreadPriority

• 0x412ba0 SetThreadPriority

• 0x412ba4 GetPriorityClass

• 0x412ba8 SetPriorityClass

• 0x412bac VirtualQuery

• 0x412bb0 WideCharToMultiByte

• 0x412bb4 DeleteFileA

• 0x412bb8 CopyFileA

• 0x412bbc WriteFile

• 0x412bc0 ReadFile

• 0x412bc4 GetSystemTimeAsFileTime

• 0x412bc8 FindFirstFileA

• 0x412bcc FindNextFileA

• 0x412bd0 FindClose

• 0x412bd4 RtlUnwind

• 0x412bd8 FileTimeToLocalFileTime

• 0x412bdc FileTimeToSystemTime

• 0x412be0 ExitProcess

• 0x412be4 VirtualAlloc

• 0x412be8 HeapCreate

• 0x412bec HeapDestroy

• 0x412bf0 HeapAlloc

• 0x412bf4 HeapReAlloc

• 0x412bf8 HeapFree

• 0x412bfc HeapSize

• 0x412c00 HeapValidate

• 0x412c04 GetStartupInfoA

• 0x412c08 GetFileType

• 0x412c0c GetStdHandle

• 0x412c10 SetHandleCount

• 0x412c14 GetModuleFileNameA

• 0x412c18 GetEnvironmentStrings

• 0x412c1c FreeEnvironmentStringsA

• 0x412c20 UnhandledExceptionFilter

• 0x412c24 GetConsoleMode

• 0x412c28 GetConsoleOutputCP

• 0x412c2c SetStdHandle

• 0x412c30 MultiByteToWideChar

• 0x412c34 GetConsoleCP

• 0x412c38 GetSystemTime

• 0x412c3c GetTimeZoneInformation

Library USER32.dll:

• 0x412c44 CharToOemA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	63429	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	55369	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.