SmartHawk

0.8

低危

该样本未表现出任何异常！

重新分析

下载样本

0a3e4a99ada38c4929404afef869b52a92bd457370a4231c28bf158d8535f0c7

965315394a9f86383bccbc2e9a4e6835.exe

分析耗时

20s

查杀引擎	查杀时间	查杀版本
McAfee	20210102	6.0.6.653
Alibaba	20190527	0.3.0.5
Baidu	20190318	1.0.0.2
Avast	20210102	21.1.5827.0
Kingsoft	20210103	2017.9.26.565
Tencent	20210103	1.0.0.1
CrowdStrike	20190702	1.0

Time & API	Arguments	Status	Return	Repeated
1620952196.785875 WriteConsoleW	buffer: FC: 文件规范数不足 console_handle: 0x00000017	success	1	0

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2001-08-18 04:53:11

Imports

Library msvcrt.dll:

• 0x1001008 memmove

• 0x100100c _wcsicmp

• 0x1001010 _wcsupr

• 0x1001014 _c_exit

• 0x1001018 _exit

• 0x100101c _XcptFilter

• 0x1001020 _cexit

• 0x1001024 exit

• 0x1001028 __initenv

• 0x100102c __getmainargs

• 0x1001030 wcslen

• 0x1001034 __setusermatherr

• 0x1001038 _adjust_fdiv

• 0x100103c __p__commode

• 0x1001040 __p__fmode

• 0x1001044 __set_app_type

• 0x1001048 _controlfp

• 0x100104c _except_handler3

• 0x1001050 _initterm

• 0x1001054 sprintf

Library KERNEL32.dll:

• 0x1001000 GetModuleHandleA

Library ulib.dll:

• 0x1001068 ?ValidateVersion@PROGRAM@@UBEXKK@Z

• 0x100106c ?Usage@PROGRAM@@UBEXXZ

• 0x1001070 ?GetStandardError@PROGRAM@@UAEPAVSTREAM@@XZ

• 0x1001074 ?GetStandardOutput@PROGRAM@@UAEPAVSTREAM@@XZ

• 0x1001078 ?GetStandardInput@PROGRAM@@UAEPAVSTREAM@@XZ

• 0x100107c ?Fatal@PROGRAM@@UBEXXZ

• 0x1001080 ?Fatal@PROGRAM@@UBAXKKPADZZ

• 0x1001084 ?DisplayMessage@PROGRAM@@UBEEKW4MESSAGE_TYPE@@@Z

• 0x1001088 ?DisplayMessage@PROGRAM@@UBAEKW4MESSAGE_TYPE@@PADZZ

• 0x100108c ?Compare@OBJECT@@UBEJPBV1@@Z

• 0x1001090 ??0PATH@@QAE@XZ

• 0x1001094 ??0PROGRAM@@IAE@XZ

• 0x1001098 ??1PROGRAM@@UAE@XZ

• 0x100109c ??1PATH@@UAE@XZ

• 0x10010a0 ??1OBJECT@@UAE@XZ

• 0x10010a4 ??1DSTRING@@UAE@XZ

• 0x10010a8 ??1BYTE_STREAM@@UAE@XZ

• 0x10010ac ?Initialize@BYTE_STREAM@@QAEEPAVSTREAM@@K@Z

• 0x10010b0 ?QueryStream@FSN_FILE@@QAEPAVFILE_STREAM@@W4STREAMACCESS@@K@Z

• 0x10010b4 ?QueryFile@SYSTEM@@SGPAVFSN_FILE@@PBVPATH@@EPAE@Z

• 0x10010b8 ?Initialize@PATH@@QAEEPBVWSTRING@@E@Z

• 0x10010bc ??0BYTE_STREAM@@QAE@XZ

• 0x10010c0 ?Strcmps@WSTRING@@SGHPAG0@Z

• 0x10010c4 ?ReadWLine@STREAM@@QAEEPAGKPAKEK@Z

• 0x10010c8 ?FillAndReadByte@BYTE_STREAM@@AAEEPAE@Z

• 0x10010cc ?ReadMbLine@STREAM@@QAEEPADKPAKEK@Z

• 0x10010d0 ?Initialize@FSTRING@@QAEPAVWSTRING@@PAGK@Z

• 0x10010d4 ??0FSTRING@@QAE@XZ

• 0x10010d8 ??1ARGUMENT_LEXEMIZER@@UAE@XZ

• 0x10010dc ??1ARRAY@@UAE@XZ

• 0x10010e0 ??1STRING_ARGUMENT@@UAE@XZ

• 0x10010e4 ??1PATH_ARGUMENT@@UAE@XZ

• 0x10010e8 ?Stricmp@WSTRING@@SGHPAG0@Z

• 0x10010ec ?Strcmp@WSTRING@@SGHPAG0@Z

• 0x10010f0 ?Strcmpis@WSTRING@@SGHPAG0@Z

• 0x10010f4 ?Stricmp@MBSTR@@SGHPAD0@Z

• 0x10010f8 ?Strcmpis@MBSTR@@SGHPAD0@Z

• 0x10010fc ??0DSTRING@@QAE@XZ

• 0x1001100 ?QueryNumber@WSTRING@@QBEEPAJKK@Z

• 0x1001104 ?Initialize@PATH@@QAEEPBV1@E@Z

• 0x1001108 ?IsValueSet@ARGUMENT@@QAEEXZ

• 0x100110c ?DoParsing@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z

• 0x1001110 ?Put@ARRAY@@UAEEPAVOBJECT@@@Z

• 0x1001114 ?Initialize@STRING_ARGUMENT@@QAEEPAD@Z

• 0x1001118 ?Initialize@LONG_ARGUMENT@@QAEEPAD@Z

• 0x100111c ?Initialize@FLAG_ARGUMENT@@QAEEPAD@Z

• 0x1001120 ?Initialize@PATH_ARGUMENT@@QAEEPADE@Z

• 0x1001124 ?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z

• 0x1001128 ?PutSeparators@ARGUMENT_LEXEMIZER@@QAEXPBD@Z

• 0x100112c ?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z

• 0x1001130 ?PutSwitches@ARGUMENT_LEXEMIZER@@QAEXPBD@Z

• 0x1001134 ?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z

• 0x1001138 ?Initialize@ARRAY@@QAEEKK@Z

• 0x100113c ??0STRING_ARGUMENT@@QAE@XZ

• 0x1001140 ??0LONG_ARGUMENT@@QAE@XZ

• 0x1001144 ??0FLAG_ARGUMENT@@QAE@XZ

• 0x1001148 ??0PATH_ARGUMENT@@QAE@XZ

• 0x100114c ??0ARRAY@@QAE@XZ

• 0x1001150 ??0ARGUMENT_LEXEMIZER@@QAE@XZ

• 0x1001154 ?Initialize@PROGRAM@@QAEEKKK@Z

• 0x1001158 ??1FSN_FILTER@@UAE@XZ

• 0x100115c ?SetName@PATH@@QAEEPBVWSTRING@@@Z

• 0x1001160 ?QueryWCExpansion@PATH@@QAEPAV1@PAV1@@Z

• 0x1001164 ?HasWildCard@PATH@@QBEEXZ

• 0x1001168 ?QueryFsnodeArray@FSN_DIRECTORY@@QBEPAVARRAY@@PAVFSN_FILTER@@@Z

• 0x100116c ?QueryDirectory@SYSTEM@@SGPAVFSN_DIRECTORY@@PBVPATH@@E@Z

• 0x1001170 ?TruncateBase@PATH@@QAEEXZ

• 0x1001174 ?SetAttributes@FSN_FILTER@@QAEEKKK@Z

• 0x1001178 ?SetFileName@FSN_FILTER@@QAEEPBVWSTRING@@@Z

• 0x100117c ?Initialize@FSN_FILTER@@QAEEXZ

• 0x1001180 ??0FSN_FILTER@@QAE@XZ

• 0x1001184 ?Initialize@CLASS_DESCRIPTOR@@QAEEXZ

• 0x1001188 ??0CLASS_DESCRIPTOR@@QAE@XZ

• 0x100118c ?Initialize@WSTRING@@QAEEPBDK@Z

• 0x1001190 ?QueryString@WSTRING@@QBEPAV1@KK@Z

• 0x1001194 ?Strcmps@MBSTR@@SGHPAD0@Z

Library ntdll.dll:

• 0x100105c RtlFreeHeap

• 0x1001060 RtlAllocateHeap

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	50002	114.114.114.114	53
192.168.56.101	51378	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	53237	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	65004	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	53238	239.255.255.250	3702
192.168.56.101	56809	239.255.255.250	1900
192.168.56.101	58368	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.