SmartHawk

4.8

中危

9 个模型检测该样本为恶意！

重新分析

下载样本

7183772635096e82a22623ade3d9119fb511b2562ea291369306af30c47fc945

84057951c9d7e057d0b064fcde4557bd.exe

分析耗时

434s

查杀引擎	查杀结果	查杀时间	查杀版本
McAfee	Artemis!84057951C9D7	20200922	6.0.6.653
Alibaba		20190527	0.3.0.5
Baidu		20190318	1.0.0.2
Avast		20200923	18.4.3895.0
Kingsoft		20200923	2013.8.14.323
Tencent		20200923	1.0.0.1
CrowdStrike		20190702	1.0

Time & API	Arguments	Status	Return	Repeated
1620946613.874125 GlobalMemoryStatusEx		success	1	0

Time & API	Arguments	Status	Return	Repeated
1620946613.281125 NtAllocateVirtualMemory	process_identifier: 2636 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x003f0000	success	0	0
1620946683.4065 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x00000000041f0000	success	0	0

Time & API	Arguments	Status	Return	Repeated
1620946628.9535 SetWindowsHookExW	thread_identifier: 0 callback_function: 0x00000000ff35ae10 module_address: 0x00000000ff2b0000 hook_identifier: 13 (WH_KEYBOARD_LL)	success	1114517	0

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

1992-06-20 06:22:17

Imports

Library kernel32.dll:

• 0x493190 DeleteCriticalSection

• 0x493194 LeaveCriticalSection

• 0x493198 EnterCriticalSection

• 0x49319c InitializeCriticalSection

• 0x4931a0 VirtualFree

• 0x4931a4 VirtualAlloc

• 0x4931a8 LocalFree

• 0x4931ac LocalAlloc

• 0x4931b0 GetVersion

• 0x4931b4 GetCurrentThreadId

• 0x4931b8 InterlockedDecrement

• 0x4931bc InterlockedIncrement

• 0x4931c0 VirtualQuery

• 0x4931c4 WideCharToMultiByte

• 0x4931c8 RemoveDirectoryA

• 0x4931cc MultiByteToWideChar

• 0x4931d0 lstrlenA

• 0x4931d4 lstrcpynA

• 0x4931d8 LoadLibraryExA

• 0x4931dc GetThreadLocale

• 0x4931e0 GetStartupInfoA

• 0x4931e4 GetProcAddress

• 0x4931e8 GetModuleHandleA

• 0x4931ec GetModuleFileNameA

• 0x4931f0 GetLocaleInfoA

• 0x4931f4 GetLastError

• 0x4931f8 GetCommandLineA

• 0x4931fc FreeLibrary

• 0x493200 FindFirstFileA

• 0x493204 FindClose

• 0x493208 CreateDirectoryA

• 0x49320c ExitProcess

• 0x493210 WriteFile

• 0x493214 UnhandledExceptionFilter

• 0x493218 SetFilePointer

• 0x49321c SetEndOfFile

• 0x493220 RtlUnwind

• 0x493224 ReadFile

• 0x493228 RaiseException

• 0x49322c GetStdHandle

• 0x493230 GetFileSize

• 0x493234 GetFileType

• 0x493238 CreateFileA

• 0x49323c CloseHandle

Library user32.dll:

• 0x493244 GetKeyboardType

• 0x493248 LoadStringA

• 0x49324c MessageBoxA

• 0x493250 CharNextA

Library advapi32.dll:

• 0x493258 RegQueryValueExA

• 0x49325c RegOpenKeyExA

• 0x493260 RegCloseKey

Library oleaut32.dll:

• 0x493268 SysFreeString

• 0x49326c SysReAllocStringLen

• 0x493270 SysAllocStringLen

Library kernel32.dll:

• 0x493278 TlsSetValue

• 0x49327c TlsGetValue

• 0x493280 LocalAlloc

• 0x493284 GetModuleHandleA

Library advapi32.dll:

• 0x49328c RegQueryValueExA

• 0x493290 RegOpenKeyExA

• 0x493294 RegFlushKey

• 0x493298 RegCreateKeyExA

• 0x49329c RegCloseKey

Library kernel32.dll:

• 0x4932a4 lstrcpyA

• 0x4932a8 WritePrivateProfileStringA

• 0x4932ac WriteFile

• 0x4932b0 WideCharToMultiByte

• 0x4932b4 WaitForSingleObject

• 0x4932b8 VirtualQuery

• 0x4932bc VirtualProtect

• 0x4932c0 VirtualFree

• 0x4932c4 VirtualAlloc

• 0x4932c8 UnmapViewOfFile

• 0x4932cc Sleep

• 0x4932d0 SizeofResource

• 0x4932d4 SetThreadLocale

• 0x4932d8 SetFileTime

• 0x4932dc SetFilePointer

• 0x4932e0 SetFileAttributesW

• 0x4932e4 SetFileAttributesA

• 0x4932e8 SetEvent

• 0x4932ec SetErrorMode

• 0x4932f0 SetEndOfFile

• 0x4932f4 ResetEvent

• 0x4932f8 ReleaseMutex

• 0x4932fc ReadFile

• 0x493300 OpenFileMappingA

• 0x493304 MultiByteToWideChar

• 0x493308 MulDiv

• 0x49330c MapViewOfFile

• 0x493310 LockResource

• 0x493314 LocalFileTimeToFileTime

• 0x493318 LoadResource

• 0x49331c LoadLibraryA

• 0x493320 LeaveCriticalSection

• 0x493324 IsBadReadPtr

• 0x493328 InitializeCriticalSection

• 0x49332c HeapFree

• 0x493330 HeapAlloc

• 0x493334 GlobalUnlock

• 0x493338 GlobalSize

• 0x49333c GlobalReAlloc

• 0x493340 GlobalHandle

• 0x493344 GlobalLock

• 0x493348 GlobalFree

• 0x49334c GlobalFindAtomA

• 0x493350 GlobalDeleteAtom

• 0x493354 GlobalAlloc

• 0x493358 GlobalAddAtomA

• 0x49335c GetVersionExA

• 0x493360 GetVersion

• 0x493364 GetUserDefaultLCID

• 0x493368 GetTickCount

• 0x49336c GetThreadLocale

• 0x493370 GetSystemInfo

• 0x493374 GetStringTypeExA

• 0x493378 GetStdHandle

• 0x49337c GetProcessHeap

• 0x493380 GetProcAddress

• 0x493384 GetPrivateProfileStringA

• 0x493388 GetModuleHandleA

• 0x49338c GetModuleFileNameA

• 0x493390 GetLocaleInfoA

• 0x493394 GetLocalTime

• 0x493398 GetLastError

• 0x49339c GetFullPathNameA

• 0x4933a0 GetFileAttributesW

• 0x4933a4 GetFileAttributesA

• 0x4933a8 GetDriveTypeW

• 0x4933ac GetDiskFreeSpaceA

• 0x4933b0 GetDateFormatA

• 0x4933b4 GetCurrentThreadId

• 0x4933b8 GetCurrentProcessId

• 0x4933bc GetComputerNameA

• 0x4933c0 GetCPInfo

• 0x4933c4 GetACP

• 0x4933c8 FreeResource

• 0x4933cc InterlockedIncrement

• 0x4933d0 InterlockedExchange

• 0x4933d4 InterlockedDecrement

• 0x4933d8 InterlockedCompareExchange

• 0x4933dc FreeLibrary

• 0x4933e0 FormatMessageA

• 0x4933e4 FindResourceA

• 0x4933e8 FindNextFileA

• 0x4933ec FindFirstFileW

• 0x4933f0 FindFirstFileA

• 0x4933f4 FindClose

• 0x4933f8 FileTimeToLocalFileTime

• 0x4933fc FileTimeToDosDateTime

• 0x493400 EnumCalendarInfoA

• 0x493404 EnterCriticalSection

• 0x493408 DosDateTimeToFileTime

• 0x49340c DeleteFileA

• 0x493410 DeleteCriticalSection

• 0x493414 CreateThread

• 0x493418 CreateFileMappingA

• 0x49341c CreateFileW

• 0x493420 CreateFileA

• 0x493424 CreateEventA

• 0x493428 CreateDirectoryW

• 0x49342c CreateDirectoryA

• 0x493430 CompareStringW

• 0x493434 CompareStringA

• 0x493438 CloseHandle

Library version.dll:

• 0x493440 VerQueryValueA

• 0x493444 GetFileVersionInfoSizeA

• 0x493448 GetFileVersionInfoA

Library gdi32.dll:

• 0x493450 UnrealizeObject

• 0x493454 StretchBlt

• 0x493458 SetWindowOrgEx

• 0x49345c SetWinMetaFileBits

• 0x493460 SetViewportOrgEx

• 0x493464 SetTextColor

• 0x493468 SetStretchBltMode

• 0x49346c SetROP2

• 0x493470 SetPixel

• 0x493474 SetEnhMetaFileBits

• 0x493478 SetDIBColorTable

• 0x49347c SetBrushOrgEx

• 0x493480 SetBkMode

• 0x493484 SetBkColor

• 0x493488 SelectPalette

• 0x49348c SelectObject

• 0x493490 SaveDC

• 0x493494 RestoreDC

• 0x493498 Rectangle

• 0x49349c RectVisible

• 0x4934a0 RealizePalette

• 0x4934a4 Polyline

• 0x4934a8 PlayEnhMetaFile

• 0x4934ac Pie

• 0x4934b0 PatBlt

• 0x4934b4 MoveToEx

• 0x4934b8 MaskBlt

• 0x4934bc LineTo

• 0x4934c0 IntersectClipRect

• 0x4934c4 GetWindowOrgEx

• 0x4934c8 GetWinMetaFileBits

• 0x4934cc GetTextMetricsA

• 0x4934d0 GetTextExtentPoint32A

• 0x4934d4 GetSystemPaletteEntries

• 0x4934d8 GetStockObject

• 0x4934dc GetPixel

• 0x4934e0 GetPaletteEntries

• 0x4934e4 GetObjectA

• 0x4934e8 GetEnhMetaFilePaletteEntries

• 0x4934ec GetEnhMetaFileHeader

• 0x4934f0 GetEnhMetaFileDescriptionA

• 0x4934f4 GetEnhMetaFileBits

• 0x4934f8 GetDeviceCaps

• 0x4934fc GetDIBits

• 0x493500 GetDIBColorTable

• 0x493504 GetDCOrgEx

• 0x493508 GetCurrentPositionEx

• 0x49350c GetClipBox

• 0x493510 GetBrushOrgEx

• 0x493514 GetBitmapBits

• 0x493518 GdiFlush

• 0x49351c ExtTextOutA

• 0x493520 ExcludeClipRect

• 0x493524 Ellipse

• 0x493528 DeleteObject

• 0x49352c DeleteEnhMetaFile

• 0x493530 DeleteDC

• 0x493534 CreateSolidBrush

• 0x493538 CreatePenIndirect

• 0x49353c CreatePalette

• 0x493540 CreateHalftonePalette

• 0x493544 CreateFontIndirectA

• 0x493548 CreateEnhMetaFileA

• 0x49354c CreateDIBitmap

• 0x493550 CreateDIBSection

• 0x493554 CreateCompatibleDC

• 0x493558 CreateCompatibleBitmap

• 0x49355c CreateBrushIndirect

• 0x493560 CreateBitmap

• 0x493564 CopyEnhMetaFileA

• 0x493568 CloseEnhMetaFile

• 0x49356c BitBlt

Library user32.dll:

• 0x493574 CreateWindowExA

• 0x493578 WindowFromPoint

• 0x49357c WinHelpA

• 0x493580 WaitMessage

• 0x493584 UpdateWindow

• 0x493588 UnregisterClassA

• 0x49358c UnhookWindowsHookEx

• 0x493590 TranslateMessage

• 0x493594 TranslateMDISysAccel

• 0x493598 TrackPopupMenu

• 0x49359c SystemParametersInfoA

• 0x4935a0 ShowWindow

• 0x4935a4 ShowScrollBar

• 0x4935a8 ShowOwnedPopups

• 0x4935ac ShowCursor

• 0x4935b0 SetWindowsHookExA

• 0x4935b4 SetWindowTextA

• 0x4935b8 SetWindowPos

• 0x4935bc SetWindowPlacement

• 0x4935c0 SetWindowLongA

• 0x4935c4 SetTimer

• 0x4935c8 SetScrollRange

• 0x4935cc SetScrollPos

• 0x4935d0 SetScrollInfo

• 0x4935d4 SetRect

• 0x4935d8 SetPropA

• 0x4935dc SetParent

• 0x4935e0 SetMenuItemInfoA

• 0x4935e4 SetMenu

• 0x4935e8 SetForegroundWindow

• 0x4935ec SetFocus

• 0x4935f0 SetCursor

• 0x4935f4 SetClassLongA

• 0x4935f8 SetCapture

• 0x4935fc SetActiveWindow

• 0x493600 SendMessageA

• 0x493604 ScrollWindow

• 0x493608 ScreenToClient

• 0x49360c RemovePropA

• 0x493610 RemoveMenu

• 0x493614 ReleaseDC

• 0x493618 ReleaseCapture

• 0x49361c RegisterWindowMessageA

• 0x493620 RegisterClipboardFormatA

• 0x493624 RegisterClassA

• 0x493628 RedrawWindow

• 0x49362c PtInRect

• 0x493630 PostQuitMessage

• 0x493634 PostMessageA

• 0x493638 PeekMessageA

• 0x49363c OffsetRect

• 0x493640 OemToCharA

• 0x493644 MessageBoxA

• 0x493648 MapWindowPoints

• 0x49364c MapVirtualKeyA

• 0x493650 LoadStringA

• 0x493654 LoadKeyboardLayoutA

• 0x493658 LoadIconA

• 0x49365c LoadCursorA

• 0x493660 LoadBitmapA

• 0x493664 KillTimer

• 0x493668 IsZoomed

• 0x49366c IsWindowVisible

• 0x493670 IsWindowEnabled

• 0x493674 IsWindow

• 0x493678 IsRectEmpty

• 0x49367c IsIconic

• 0x493680 IsDialogMessageA

• 0x493684 IsChild

• 0x493688 InvalidateRect

• 0x49368c IntersectRect

• 0x493690 InsertMenuItemA

• 0x493694 InsertMenuA

• 0x493698 InflateRect

• 0x49369c GetWindowThreadProcessId

• 0x4936a0 GetWindowTextA

• 0x4936a4 GetWindowRect

• 0x4936a8 GetWindowPlacement

• 0x4936ac GetWindowLongA

• 0x4936b0 GetWindowDC

• 0x4936b4 GetTopWindow

• 0x4936b8 GetSystemMetrics

• 0x4936bc GetSystemMenu

• 0x4936c0 GetSysColorBrush

• 0x4936c4 GetSysColor

• 0x4936c8 GetSubMenu

• 0x4936cc GetScrollRange

• 0x4936d0 GetScrollPos

• 0x4936d4 GetScrollInfo

• 0x4936d8 GetPropA

• 0x4936dc GetParent

• 0x4936e0 GetWindow

• 0x4936e4 GetMessageTime

• 0x4936e8 GetMenuStringA

• 0x4936ec GetMenuState

• 0x4936f0 GetMenuItemInfoA

• 0x4936f4 GetMenuItemID

• 0x4936f8 GetMenuItemCount

• 0x4936fc GetMenu

• 0x493700 GetLastActivePopup

• 0x493704 GetKeyboardState

• 0x493708 GetKeyboardLayoutList

• 0x49370c GetKeyboardLayout

• 0x493710 GetKeyState

• 0x493714 GetKeyNameTextA

• 0x493718 GetIconInfo

• 0x49371c GetForegroundWindow

• 0x493720 GetFocus

• 0x493724 GetDesktopWindow

• 0x493728 GetDCEx

• 0x49372c GetDC

• 0x493730 GetCursorPos

• 0x493734 GetCursor

• 0x493738 GetClipboardData

• 0x49373c GetClientRect

• 0x493740 GetClassNameA

• 0x493744 GetClassInfoA

• 0x493748 GetCapture

• 0x49374c GetActiveWindow

• 0x493750 FrameRect

• 0x493754 FindWindowA

• 0x493758 FillRect

• 0x49375c EqualRect

• 0x493760 EnumWindows

• 0x493764 EnumThreadWindows

• 0x493768 EndPaint

• 0x49376c EnableWindow

• 0x493770 EnableScrollBar

• 0x493774 EnableMenuItem

• 0x493778 DrawTextA

• 0x49377c DrawMenuBar

• 0x493780 DrawIconEx

• 0x493784 DrawIcon

• 0x493788 DrawFrameControl

• 0x49378c DrawEdge

• 0x493790 DispatchMessageA

• 0x493794 DestroyWindow

• 0x493798 DestroyMenu

• 0x49379c DestroyIcon

• 0x4937a0 DestroyCursor

• 0x4937a4 DeleteMenu

• 0x4937a8 DefWindowProcA

• 0x4937ac DefMDIChildProcA

• 0x4937b0 DefFrameProcA

• 0x4937b4 CreatePopupMenu

• 0x4937b8 CreateMenu

• 0x4937bc CreateIcon

• 0x4937c0 ClientToScreen

• 0x4937c4 CheckMenuItem

• 0x4937c8 CharUpperBuffW

• 0x4937cc CallWindowProcA

• 0x4937d0 CallNextHookEx

• 0x4937d4 BeginPaint

• 0x4937d8 CharNextA

• 0x4937dc CharLowerBuffA

• 0x4937e0 CharLowerA

• 0x4937e4 CharUpperBuffA

• 0x4937e8 CharToOemA

• 0x4937ec AdjustWindowRectEx

• 0x4937f0 ActivateKeyboardLayout

Library kernel32.dll:

• 0x4937f8 Sleep

Library oleaut32.dll:

• 0x493800 SafeArrayPtrOfIndex

• 0x493804 SafeArrayGetUBound

• 0x493808 SafeArrayGetLBound

• 0x49380c SafeArrayCreate

• 0x493810 VariantChangeType

• 0x493814 VariantCopy

• 0x493818 VariantClear

• 0x49381c VariantInit

Library ole32.dll:

• 0x493824 CreateStreamOnHGlobal

• 0x493828 IsAccelerator

• 0x49382c OleDraw

• 0x493830 OleSetMenuDescriptor

• 0x493834 CoTaskMemFree

• 0x493838 ProgIDFromCLSID

• 0x49383c StringFromCLSID

• 0x493840 CoCreateInstance

• 0x493844 CoGetClassObject

• 0x493848 CoUninitialize

• 0x49384c CoInitialize

• 0x493850 IsEqualGUID

Library oleaut32.dll:

• 0x493858 GetErrorInfo

• 0x49385c GetActiveObject

• 0x493860 SysFreeString

• 0x493864 SysAllocString

Library comctl32.dll:

• 0x49386c ImageList_SetIconSize

• 0x493870 ImageList_GetIconSize

• 0x493874 ImageList_Write

• 0x493878 ImageList_Read

• 0x49387c ImageList_GetDragImage

• 0x493880 ImageList_DragShowNolock

• 0x493884 ImageList_SetDragCursorImage

• 0x493888 ImageList_DragMove

• 0x49388c ImageList_DragLeave

• 0x493890 ImageList_DragEnter

• 0x493894 ImageList_EndDrag

• 0x493898 ImageList_BeginDrag

• 0x49389c ImageList_Remove

• 0x4938a0 ImageList_DrawEx

• 0x4938a4 ImageList_Replace

• 0x4938a8 ImageList_Draw

• 0x4938ac ImageList_GetBkColor

• 0x4938b0 ImageList_SetBkColor

• 0x4938b4 ImageList_ReplaceIcon

• 0x4938b8 ImageList_Add

• 0x4938bc ImageList_GetImageCount

• 0x4938c0 ImageList_Destroy

• 0x4938c4 ImageList_Create

Library shell32.dll:

• 0x4938cc ShellExecuteA

• 0x4938d0 SHFileOperationA

Library shell32.dll:

• 0x4938d8 SHGetPathFromIDListA

• 0x4938dc SHBrowseForFolderA

Library comdlg32.dll:

• 0x4938e4 GetOpenFileNameW

Library kernel32.dll:

• 0x4938ec GetVersionExA

• 0x4938f0 CreateMutexA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.24.14 CNAME clients.l.google.com	172.217.27.142
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49713	114.114.114.114	53
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	62912	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53210	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.

section	CODE
section	DATA
section	BSS

McAfee	Artemis!84057951C9D7
Zillya	Trojan.Dico.Win32.137
DrWeb	Trojan.DownLoader27.40570
McAfee-GW-Edition	Artemis
Antiy-AVL	GrayWare/Win32.Generic
Microsoft	PUA:Win32/Presenoker
VBA32	BScope.Trojan.Downloader
Ikarus	Trojan.Win32.Agent
eGambit	Unsafe.AI_Score_88%