5.4
中危

18b7b579f28b3fb6970fe908b5e1b28201f2ea30737275e0d7cc840289630691

8c1aa07d05978df6964b0ae7d0745dcc.exe

分析耗时

110s

最近分析

文件大小

2.8MB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Queries for the computername (2 个事件)
Time & API Arguments Status Return Repeated
1620846601.176874
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
1620846616.707874
GetComputerNameW
computer_name: OSKAR-PC
success 1 0
Checks if process is being debugged by a debugger (1 个事件)
Time & API Arguments Status Return Repeated
1620846587.426124
IsDebuggerPresent
failed 0 0
This executable is signed
The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 个事件)
section .itext
section .didata
行为判定
动态指标
Allocates read-write-execute memory (usually to unpack itself) (6 个事件)
Time & API Arguments Status Return Repeated
1620846586.614124
NtProtectVirtualMemory
process_identifier: 2536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00400000
success 0 0
1620846586.614124
NtProtectVirtualMemory
process_identifier: 2536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 745472
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x00401000
success 0 0
1620846586.614124
NtProtectVirtualMemory
process_identifier: 2536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004c4000
success 0 0
1620846586.614124
NtProtectVirtualMemory
process_identifier: 2536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 24576
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
base_address: 0x004c6000
success 0 0
1620846588.145874
NtAllocateVirtualMemory
process_identifier: 2040
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x02140000
success 0 0
1620846648.692374
NtAllocateVirtualMemory
process_identifier: 1424
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
process_handle: 0xffffffffffffffff
allocation_type: 4096 (MEM_COMMIT)
base_address: 0x0000000004070000
success 0 0
Checks whether any human activity is being performed by constantly checking whether the foreground window changed
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Firemin.lnk
Creates a shortcut to an executable file (2 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Firemin.lnk
file C:\Users\Public\Desktop\Google Chrome.lnk
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\is-4EM9L.tmp\8c1aa07d05978df6964b0ae7d0745dcc.tmp
Queries for potentially installed applications (4 个事件)
Time & API Arguments Status Return Repeated
1620846589.411874
RegOpenKeyExW
access: 0x00000101
base_handle: 0x80000002
key_handle: 0x00000000
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Firemin_is1
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Firemin_is1
options: 0
failed 2 0
1620846618.739874
RegOpenKeyExW
access: 0x00000101
base_handle: 0x80000002
key_handle: 0x00000000
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Firemin_is1
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Firemin_is1
options: 0
failed 2 0
1620846618.754874
RegOpenKeyExW
access: 0x00000101
base_handle: 0x80000001
key_handle: 0x00000000
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Firemin_is1
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Firemin_is1
options: 0
failed 2 0
1620846618.754874
RegOpenKeyExW
access: 0x00000001
base_handle: 0x80000002
key_handle: 0x00000000
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Firemin_is1
regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Firemin_is1
options: 0
failed 2 0
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手,可以帮您分析和解读恶意软件报告。请随时向我提问!

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2020-05-21 13:56:23

Imports

Library kernel32.dll:
0x4c22e4 GetACP
0x4c22e8 GetExitCodeProcess
0x4c22ec LocalFree
0x4c22f0 CloseHandle
0x4c22f4 SizeofResource
0x4c22f8 VirtualProtect
0x4c22fc VirtualFree
0x4c2300 GetFullPathNameW
0x4c2304 ExitProcess
0x4c2308 HeapAlloc
0x4c230c GetCPInfoExW
0x4c2310 RtlUnwind
0x4c2314 GetCPInfo
0x4c2318 GetStdHandle
0x4c231c GetModuleHandleW
0x4c2320 FreeLibrary
0x4c2324 HeapDestroy
0x4c2328 ReadFile
0x4c232c CreateProcessW
0x4c2330 GetLastError
0x4c2334 GetModuleFileNameW
0x4c2338 SetLastError
0x4c233c FindResourceW
0x4c2340 CreateThread
0x4c2344 CompareStringW
0x4c2348 LoadLibraryA
0x4c234c ResetEvent
0x4c2350 GetVersion
0x4c2354 RaiseException
0x4c2358 FormatMessageW
0x4c235c SwitchToThread
0x4c2360 GetExitCodeThread
0x4c2364 GetCurrentThread
0x4c2368 LoadLibraryExW
0x4c236c LockResource
0x4c2370 GetCurrentThreadId
0x4c2378 VirtualQuery
0x4c237c VirtualQueryEx
0x4c2380 Sleep
0x4c2388 SetFilePointer
0x4c238c LoadResource
0x4c2390 SuspendThread
0x4c2394 GetTickCount
0x4c2398 GetFileSize
0x4c239c GetStartupInfoW
0x4c23a0 GetFileAttributesW
0x4c23a8 GetThreadPriority
0x4c23ac SetThreadPriority
0x4c23b0 GetCurrentProcess
0x4c23b4 VirtualAlloc
0x4c23b8 GetSystemInfo
0x4c23bc GetCommandLineW
0x4c23c4 GetProcAddress
0x4c23c8 ResumeThread
0x4c23cc GetVersionExW
0x4c23d0 VerifyVersionInfoW
0x4c23d4 HeapCreate
0x4c23dc VerSetConditionMask
0x4c23e0 GetDiskFreeSpaceW
0x4c23e4 FindFirstFileW
0x4c23ec lstrlenW
0x4c23f4 SetEndOfFile
0x4c23f8 HeapFree
0x4c23fc WideCharToMultiByte
0x4c2400 FindClose
0x4c2404 MultiByteToWideChar
0x4c2408 LoadLibraryW
0x4c240c SetEvent
0x4c2410 CreateFileW
0x4c2414 GetLocaleInfoW
0x4c2418 GetSystemDirectoryW
0x4c241c DeleteFileW
0x4c2420 GetLocalTime
0x4c2428 WaitForSingleObject
0x4c242c WriteFile
0x4c2430 ExitThread
0x4c2438 TlsGetValue
0x4c243c GetDateFormatW
0x4c2440 SetErrorMode
0x4c2444 IsValidLocale
0x4c2448 TlsSetValue
0x4c244c CreateDirectoryW
0x4c2454 EnumCalendarInfoW
0x4c2458 LocalAlloc
0x4c2460 RemoveDirectoryW
0x4c2464 CreateEventW
0x4c2468 SetThreadLocale
0x4c246c GetThreadLocale
Library comctl32.dll:
0x4c2474 InitCommonControls
Library version.dll:
0x4c2480 VerQueryValueW
0x4c2484 GetFileVersionInfoW
Library user32.dll:
0x4c248c CreateWindowExW
0x4c2490 TranslateMessage
0x4c2494 CharLowerBuffW
0x4c2498 CallWindowProcW
0x4c249c CharUpperW
0x4c24a0 PeekMessageW
0x4c24a4 GetSystemMetrics
0x4c24a8 SetWindowLongW
0x4c24ac MessageBoxW
0x4c24b0 DestroyWindow
0x4c24b4 CharUpperBuffW
0x4c24b8 CharNextW
0x4c24c0 LoadStringW
0x4c24c4 ExitWindowsEx
0x4c24c8 DispatchMessageW
Library oleaut32.dll:
0x4c24d0 SysAllocStringLen
0x4c24d4 SafeArrayPtrOfIndex
0x4c24d8 VariantCopy
0x4c24dc SafeArrayGetLBound
0x4c24e0 SafeArrayGetUBound
0x4c24e4 VariantInit
0x4c24e8 VariantClear
0x4c24ec SysFreeString
0x4c24f0 SysReAllocStringLen
0x4c24f4 VariantChangeType
0x4c24f8 SafeArrayCreate
Library netapi32.dll:
0x4c2500 NetWkstaGetInfo
0x4c2504 NetApiBufferFree
Library advapi32.dll:
0x4c250c RegQueryValueExW
0x4c2518 RegCloseKey
0x4c251c OpenProcessToken
0x4c2520 RegOpenKeyExW

Exports

Ordinal Address Name
3 0x454058 TMethodImplementationIntercept
2 0x40d0a0 __dbk_fcall_wrapper
1 0x4be63c dbkFCallWrapperAddr

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 53380 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 56539 114.114.114.114 53
192.168.56.101 63429 114.114.114.114 53
192.168.56.101 65004 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 49713 224.0.0.252 5355
192.168.56.101 50568 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 53237 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 57236 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.