1.4
低危
1 个模型检测该样本为恶意！
重新分析
更多

84df117f2a633e6673ed54a3710101c3dab574028f98c209c888061a42954281

8483df5ca9cd33b915fe545a72bc53dc.exe

分析耗时

17s

最近分析

文件大小

71.1KB
静态报毒 动态报毒 SPIGOT
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
Alibaba 20190527 0.3.0.5
CrowdStrike 20190702 1.0
Avast 20200907 18.4.3895.0
Baidu 20190318 1.0.0.2
Kingsoft 20200907 2013.8.14.323
McAfee 20200907 6.0.6.653
Tencent 20200907 1.0.0.1
静态指标
Command line console output was observed (8 个事件)
Time & API Arguments Status Return Repeated
1620946616.398315
WriteConsoleA
buffer: SetDefaultBrowser v1.3 ====================== Copyright 2018 by Christoph Kolbicz, https://kolbi.cz usage: SetDefaultBrowser hive browser example: SetDefaultBrowser HKLM IEXPLORE.EXE shortcuts: (no hive needed, will use HKLM) chrome, ie, iexplore and edge
console_handle: 0x00000007
success 1 0
1620946616.398315
WriteConsoleA
buffer: Installed browsers: ===================
console_handle: 0x00000007
success 1 0
1620946616.398315
WriteConsoleA
buffer: HKLM Google Chrome
console_handle: 0x00000007
success 1 0
1620946616.414315
WriteConsoleA
buffer: name: Google Chrome
console_handle: 0x00000007
success 1 0
1620946616.414315
WriteConsoleA
buffer: path: "C:\Program Files\Google\Chrome\Application\chrome.exe"
console_handle: 0x00000007
success 1 0
1620946616.414315
WriteConsoleA
buffer: HKLM IEXPLORE.EXE
console_handle: 0x00000007
success 1 0
1620946616.414315
WriteConsoleA
buffer: name: Internet Explorer
console_handle: 0x00000007
success 1 0
1620946616.414315
WriteConsoleA
buffer: path: C:\Program Files (x86)\Internet Explorer\iexplore.exe
console_handle: 0x00000007
success 1 0
This executable is signed
行为判定
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

1970-01-02 02:12:16

Imports

Library ADVAPI32.dll:
• 0x4091d0 GetTokenInformation
• 0x4091d4 LookupAccountNameW
• 0x4091d8 LookupAccountSidW
• 0x4091dc OpenProcessToken
• 0x4091e0 RegCloseKey
• 0x4091e4 RegCreateKeyExW
• 0x4091e8 RegDeleteKeyW
• 0x4091ec RegEnumKeyExW
• 0x4091f0 RegOpenKeyExW
• 0x4091f4 RegQueryInfoKeyW
• 0x4091f8 RegQueryValueExW
• 0x4091fc RegSetValueExW
Library KERNEL32.dll:
• 0x409204 CloseHandle
• 0x409214 GetCommandLineW
• 0x409218 GetCurrentProcess
• 0x40921c GetCurrentProcessId
• 0x409220 GetCurrentThreadId
• 0x409224 GetLastError
• 0x409228 GetModuleHandleA
• 0x40922c GetProcAddress
• 0x409230 GetStartupInfoA
• 0x409238 GetTickCount
• 0x409244 LocalAlloc
• 0x409248 LocalFree
• 0x40924c OpenProcess
• 0x409258 Sleep
• 0x409260 TerminateProcess
• 0x409264 TlsGetValue
• 0x40926c VirtualProtect
• 0x409270 VirtualQuery
Library msvcrt.dll:
• 0x409278 __dllonexit
• 0x40927c __getmainargs
• 0x409280 __initenv
• 0x409284 __lconv_init
• 0x409288 __set_app_type
• 0x40928c __setusermatherr
• 0x409290 _acmdln
• 0x409294 _amsg_exit
• 0x409298 _cexit
• 0x40929c _fmode
• 0x4092a0 _initterm
• 0x4092a4 _iob
• 0x4092a8 _lock
• 0x4092ac _onexit
• 0x4092b0 _wcslwr_s
• 0x4092b4 calloc
• 0x4092b8 exit
• 0x4092bc fprintf
• 0x4092c0 free
• 0x4092c4 fwrite
• 0x4092c8 malloc
• 0x4092cc mbstowcs
• 0x4092d0 memcpy
• 0x4092d4 memset
• 0x4092d8 signal
• 0x4092dc strlen
• 0x4092e0 strncmp
• 0x4092e4 _unlock
• 0x4092e8 _waccess
• 0x4092ec _wcsicmp
• 0x4092f0 _wcsnicmp
• 0x4092f4 _wtoi
• 0x4092f8 abort
• 0x4092fc swprintf_s
• 0x409300 vfprintf
• 0x409304 wcscmp
• 0x409308 wcscpy
• 0x40930c wcslen
• 0x409310 wcsstr
• 0x409314 wcstok
• 0x409318 wprintf_s
Library SHELL32.DLL:
• 0x409320 CommandLineToArgvW
• 0x409324 SHChangeNotify

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50535 239.255.255.250 3702
192.168.56.101 50537 239.255.255.250 3702
192.168.56.101 56540 239.255.255.250 3702
192.168.56.101 56807 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.