2.0
低危
1 个模型检测该样本为恶意！
重新分析
更多

fe127fd9721e402904534bcc8e236cb0724d647e002f32f9ea485777a8492a69

719943fdefaf9433029b0384758e7ed2.exe

分析耗时

86s

最近分析

文件大小

5.9MB
静态报毒 动态报毒 WRONGINF
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20201011 6.0.6.653
Baidu 20190318 1.0.0.2
Alibaba 20190527 0.3.0.5
Kingsoft 20201011 2013.8.14.323
CrowdStrike 20190702 1.0
静态指标
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1620980026.388125
IsDebuggerPresent
failed 0 0
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (4 个事件)
Time & API Arguments Status Return Repeated
1620980026.654125
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x1001f000
success 0 0
1620980026.654125
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x764c1000
success 0 0
1620980026.654125
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x750d1000
success 0 0
1620980032.123125
NtProtectVirtualMemory
process_identifier: 1632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x75001000
success 0 0
Drops an executable to the user AppData folder (3 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\GLC58AA.tmp
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\GLJ58F9.tmp
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\GLK5AEE.tmp
File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)
AVG Win32:WrongInf-C [Susp]
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2001-10-26 03:47:11

Imports

Library KERNEL32.dll:
• 0x40404c lstrcpyA
• 0x404050 GetCommandLineA
• 0x404054 SetErrorMode
• 0x404058 lstrlenA
• 0x40405c MulDiv
• 0x404060 GetTempFileNameA
• 0x404068 GetModuleFileNameA
• 0x40406c GetModuleHandleA
• 0x404070 FormatMessageA
• 0x404074 lstrcatA
• 0x404078 GetLastError
• 0x40407c _lwrite
• 0x404080 _llseek
• 0x404084 GlobalUnlock
• 0x404088 _lopen
• 0x40408c GlobalAlloc
• 0x404090 GlobalFree
• 0x404094 _lclose
• 0x404098 _lcreat
• 0x40409c LoadLibraryA
• 0x4040a0 GetProcAddress
• 0x4040a4 FreeLibrary
• 0x4040a8 OpenFile
• 0x4040ac GetVersionExA
• 0x4040b0 GetCurrentProcess
• 0x4040b4 WinExec
• 0x4040b8 ExitProcess
• 0x4040bc _lread
• 0x4040c0 LocalFree
• 0x4040c4 GetTempPathA
• 0x4040c8 GlobalLock
Library USER32.dll:
• 0x4040d0 GetDC
• 0x4040d4 BeginPaint
• 0x4040d8 EndPaint
• 0x4040dc InvalidateRect
• 0x4040e0 PostQuitMessage
• 0x4040e4 SendMessageA
• 0x4040e8 DefWindowProcA
• 0x4040ec GetClientRect
• 0x4040f0 CreateWindowExA
• 0x4040f4 DrawTextA
• 0x4040f8 ReleaseDC
• 0x4040fc ShowWindow
• 0x404100 SetWindowPos
• 0x404104 UpdateWindow
• 0x404108 SetTimer
• 0x40410c LoadIconA
• 0x404110 wsprintfA
• 0x404114 MessageBoxA
• 0x404118 ExitWindowsEx
• 0x40411c RegisterClassA
• 0x404120 LoadCursorA
Library GDI32.dll:
• 0x404010 DeleteObject
• 0x404014 GetStockObject
• 0x404018 GetDeviceCaps
• 0x40401c PatBlt
• 0x404020 CreateSolidBrush
• 0x404024 TextOutA
• 0x404028 SetTextColor
• 0x40402c SetBkMode
• 0x404030 SelectObject
• 0x404034 StretchDIBits
• 0x404038 CreateFontA
• 0x40403c RealizePalette
• 0x404040 SelectPalette
• 0x404044 CreatePalette
Library ADVAPI32.dll:
• 0x404000 OpenProcessToken

Exports

Ordinal Address Name
1 0x402a80 _MainWndProc@16
2 0x403082 _StubFileWrite@12

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.