SmartHawk

5.4

中危

1 个模型检测该样本为恶意！

重新分析

下载样本

e801955ea33bb42ffc18587cab845273a595e11cd0df227b55c9353ba8f3b3bf

75e88503d39864b1e7a378de46e85cc1.exe

分析耗时

100s

最近分析

文件大小

1.4MB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

查杀引擎	查杀时间	查杀版本
Alibaba	20190527	0.3.0.5
Baidu	20190318	1.0.0.2
Avast	20191115	18.4.3895.0
Tencent	20191115	1.0.0.1
Kingsoft	20191115	2013.8.14.323
McAfee	20191113	6.0.6.653
CrowdStrike	20190702	1.0

Checks if process is being debugged by a debugger (2 个事件)

Time & API	Arguments	Status	Return	Repeated
1619602847.7005 IsDebuggerPresent		failed	0	0
1619602852.13825 IsDebuggerPresent		failed	0	0

This executable is signed

The executable uses a known packer (1 个事件)

packer

Armadillo v1.71

Allocates read-write-execute memory (usually to unpack itself) (5 个事件)

Time & API	Arguments	Status
1619602490.76627 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004080000	success
1619602852.13825 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75250000	success
1619602852.17025 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75221000	success
1619602852.20125 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75121000	success
1619602852.26325 NtProtectVirtualMemory	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x748b1000	success

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Foreign language identified in PE resource (6 个事件)

name

RT_ICON

language

LANG_JAPANESE

offset

0x00012478

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

size

0x00000128

name

RT_ICON

language

LANG_JAPANESE

offset

0x00012478

filetype

GLS_BINARY_LSB_FIRST

sublanguage

SUBLANG_DEFAULT

size

0x00000128

name

RT_DIALOG

language

LANG_JAPANESE

offset

0x00012690

filetype

data

sublanguage

SUBLANG_DEFAULT

size

0x00000124

name

RT_DIALOG

language

LANG_JAPANESE

offset

0x00012690

filetype

data

sublanguage

SUBLANG_DEFAULT

size

0x00000124

name

RT_GROUP_ICON

language

LANG_JAPANESE

offset

0x000125a0

filetype

data

sublanguage

SUBLANG_DEFAULT

size

0x00000022

name

RT_VERSION

language

LANG_JAPANESE

offset

0x000127b8

filetype

data

sublanguage

SUBLANG_DEFAULT

size

0x00000350

Creates (office) documents on the filesystem (5 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\201903181200\UpFile\DaProcess\擭楊僠僃僢僋.xls
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\201903181200\UpFile\DaProcess\擭楊僠僃僢僋峏怴梡.xls
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\201903181200\UpFile\DaProcess\eGov\屬梡巵柤曄峏.xls
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\201903181200\UpFile\DaProcess\36嫤掕.xlsm
file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\201903181200\Update.xls

Creates a shortcut to an executable file (1 个事件)

file	C:\Users\Public\Desktop\Google Chrome.lnk

Drops a binary and executes it (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\201903181200\Update.xls

File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)

TrendMicro

HEUR_VBA.SF

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1619602469.40727 SetWindowsHookExW	thread_identifier: 0 callback_function: 0x00000000ff35ae10 module_address: 0x00000000ff2b0000 hook_identifier: 13 (WH_KEYBOARD_LL)	success	721135	0

Generates some ICMP traffic

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2001-01-16 11:14:44

Imports

Library KERNEL32.dll:

• 0x40b018 ReadFile

• 0x40b01c CreateFileA

• 0x40b020 GetModuleFileNameA

• 0x40b024 WaitForSingleObject

• 0x40b028 CreateProcessA

• 0x40b02c SetFilePointer

• 0x40b030 SetCurrentDirectoryA

• 0x40b034 GetCurrentDirectoryA

• 0x40b038 MoveFileExA

• 0x40b03c DeleteFileA

• 0x40b040 SetFileAttributesA

• 0x40b044 GetFileAttributesA

• 0x40b048 lstrcatA

• 0x40b04c CreateDirectoryA

• 0x40b050 MapViewOfFile

• 0x40b054 CreateFileMappingA

• 0x40b058 GlobalAlloc

• 0x40b05c GlobalReAlloc

• 0x40b060 GlobalSize

• 0x40b064 GlobalFree

• 0x40b068 GlobalHandle

• 0x40b06c WriteFile

• 0x40b070 _lclose

• 0x40b074 SetFileTime

• 0x40b078 LocalFileTimeToFileTime

• 0x40b07c DosDateTimeToFileTime

• 0x40b080 GetTempPathA

• 0x40b084 MulDiv

• 0x40b088 GetSystemDirectoryA

• 0x40b08c GetWindowsDirectoryA

• 0x40b090 UnmapViewOfFile

• 0x40b094 lstrcpyA

• 0x40b098 lstrlenA

• 0x40b09c GlobalUnlock

• 0x40b0a0 GlobalLock

• 0x40b0a4 LoadLibraryA

• 0x40b0a8 GetModuleHandleA

• 0x40b0ac GetStartupInfoA

• 0x40b0b0 GetStringTypeA

• 0x40b0b4 LCMapStringW

• 0x40b0b8 GetStringTypeW

• 0x40b0bc MultiByteToWideChar

• 0x40b0c0 RtlUnwind

• 0x40b0c4 LCMapStringA

• 0x40b0c8 GetStdHandle

• 0x40b0cc SetHandleCount

• 0x40b0d0 GetFileType

• 0x40b0d4 GetProcAddress

• 0x40b0d8 CloseHandle

• 0x40b0dc GetCommandLineA

• 0x40b0e0 GetVersion

• 0x40b0e4 GetEnvironmentStrings

• 0x40b0e8 WideCharToMultiByte

• 0x40b0ec GetEnvironmentStringsW

• 0x40b0f0 FreeEnvironmentStringsA

• 0x40b0f4 UnhandledExceptionFilter

• 0x40b0f8 FreeEnvironmentStringsW

• 0x40b0fc TerminateProcess

• 0x40b100 GetCurrentProcess

• 0x40b104 VirtualFree

• 0x40b108 HeapCreate

• 0x40b10c GetVersionExA

• 0x40b110 GetEnvironmentVariableA

• 0x40b114 HeapReAlloc

• 0x40b118 VirtualAlloc

• 0x40b11c HeapFree

• 0x40b120 HeapAlloc

• 0x40b124 GetOEMCP

• 0x40b128 HeapDestroy

• 0x40b12c GetCPInfo

• 0x40b130 ExitProcess

• 0x40b134 GetACP

Library USER32.dll:

• 0x40b150 SetWindowTextA

• 0x40b154 EndDialog

• 0x40b158 MoveWindow

• 0x40b15c GetSystemMetrics

• 0x40b160 GetWindowRect

• 0x40b164 SetPropA

• 0x40b168 RemovePropA

• 0x40b16c SendDlgItemMessageA

• 0x40b170 GetDlgItemTextA

• 0x40b174 DialogBoxParamA

• 0x40b178 MessageBoxA

• 0x40b17c GetWindowTextA

• 0x40b180 wsprintfA

• 0x40b184 TranslateMessage

• 0x40b188 PeekMessageA

• 0x40b18c IsDialogMessageA

• 0x40b190 SetDlgItemTextA

• 0x40b194 DispatchMessageA

• 0x40b198 GetPropA

• 0x40b19c CreateDialogParamA

• 0x40b1a0 IsWindow

• 0x40b1a4 DestroyWindow

• 0x40b1a8 SetWindowLongA

• 0x40b1ac GetWindowLongA

Library ADVAPI32.dll:

• 0x40b000 RegQueryValueExA

• 0x40b004 RegOpenKeyExA

• 0x40b008 RegCloseKey

Library SHELL32.dll:

• 0x40b13c DragQueryFileA

• 0x40b140 SHChangeNotify

• 0x40b144 ShellExecuteA

• 0x40b148 DragFinish

Library COMCTL32.dll:

• 0x40b010

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com		127.0.0.1

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50003	239.255.255.250	3702
192.168.56.101	50005	239.255.255.250	3702
192.168.56.101	51966	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.