2.4
中危
1 个模型检测该样本为恶意！
重新分析
更多

6f2e17367721570a29c388ab4a5c41444e38e23c1a7b6ab2dbe4a9384dba6389

999b778b77ee3ac4db3d4c43bcbc0df1.exe

分析耗时

31s

最近分析

文件大小

475.0KB
静态报毒 动态报毒 UNSAFE
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20180828 6.0.6.653
Baidu 20180828 1.0.0.2
Avast 20180828 18.4.3895.0
Tencent 20180828 1.0.0.1
Kingsoft 20180828 2013.8.14.323
CrowdStrike 20180723 1.0
静态指标
This executable has a PDB path (1 个事件)
pdb_path C:\Users\paulb\code\Squirrel\squirrel.windows\src\StubExecutable\bin\Release\StubExecutable.pdb
One or more processes crashed (1 个事件)
Time & API Arguments Status Return Repeated
1620825062.029875
__exception__
stacktrace: 
999b778b77ee3ac4db3d4c43bcbc0df1+0x47c2 @ 0x4047c2
999b778b77ee3ac4db3d4c43bcbc0df1+0x414a @ 0x40414a
999b778b77ee3ac4db3d4c43bcbc0df1+0x4575 @ 0x404575
999b778b77ee3ac4db3d4c43bcbc0df1+0x8a62 @ 0x408a62
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763533ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77d69ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77d69ea5

registers.esp: 1636912
registers.edi: 1638100
registers.eax: 0
registers.ebp: 1636916
registers.edx: 0
registers.ebx: 0
registers.esi: 2
registers.ecx: 1638100
exception.instruction_r: 66 8b 02 83 c2 02 66 85 c0 75 f5 2b d6 d1 fa 52
exception.symbol: 999b778b77ee3ac4db3d4c43bcbc0df1+0x4729
exception.instruction: mov ax, word ptr [edx]
exception.module: 999b778b77ee3ac4db3d4c43bcbc0df1.exe
exception.exception_code: 0xc0000005
exception.offset: 18217
exception.address: 0x404729
success 0 0
行为判定
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2017-06-03 04:41:00

Imports

Library KERNEL32.dll:
• 0x41d000 GetModuleFileNameW
• 0x41d004 GetModuleHandleW
• 0x41d008 FindFirstFileW
• 0x41d00c FindNextFileW
• 0x41d010 FindClose
• 0x41d014 CreateProcessW
• 0x41d018 WriteConsoleW
• 0x41d01c FlushFileBuffers
• 0x41d020 SetFilePointerEx
• 0x41d024 WideCharToMultiByte
• 0x41d028 MultiByteToWideChar
• 0x41d02c GetStringTypeW
• 0x41d030 EncodePointer
• 0x41d034 DecodePointer
• 0x41d044 SetLastError
• 0x41d04c CreateEventW
• 0x41d050 TlsAlloc
• 0x41d054 TlsGetValue
• 0x41d058 TlsSetValue
• 0x41d05c TlsFree
• 0x41d064 GetProcAddress
• 0x41d068 LCMapStringW
• 0x41d06c GetLocaleInfoW
• 0x41d070 GetCPInfo
• 0x41d074 CloseHandle
• 0x41d078 SetEvent
• 0x41d07c ResetEvent
• 0x41d08c GetCurrentProcess
• 0x41d090 TerminateProcess
• 0x41d098 IsDebuggerPresent
• 0x41d09c GetStartupInfoW
• 0x41d0a4 GetCurrentProcessId
• 0x41d0a8 GetCurrentThreadId
• 0x41d0ac InitializeSListHead
• 0x41d0b0 RtlUnwind
• 0x41d0b4 RaiseException
• 0x41d0b8 GetLastError
• 0x41d0bc FreeLibrary
• 0x41d0c0 LoadLibraryExW
• 0x41d0c4 HeapAlloc
• 0x41d0c8 HeapReAlloc
• 0x41d0cc HeapFree
• 0x41d0d0 ExitProcess
• 0x41d0d4 GetModuleHandleExW
• 0x41d0d8 GetStdHandle
• 0x41d0dc WriteFile
• 0x41d0e0 GetACP
• 0x41d0e4 IsValidLocale
• 0x41d0e8 GetUserDefaultLCID
• 0x41d0ec EnumSystemLocalesW
• 0x41d0f0 GetProcessHeap
• 0x41d0f4 GetFileType
• 0x41d0f8 FindFirstFileExW
• 0x41d0fc IsValidCodePage
• 0x41d100 GetOEMCP
• 0x41d104 GetCommandLineA
• 0x41d108 GetCommandLineW
• 0x41d114 SetStdHandle
• 0x41d118 HeapSize
• 0x41d11c GetConsoleCP
• 0x41d120 GetConsoleMode
• 0x41d124 CreateFileW
Library USER32.dll:
• 0x41d130 WaitForInputIdle

Hosts

No hosts contacted.

TCP

No TCP connections recorded.

UDP

Source Source Port Destination Destination Port
192.168.56.101 49235 114.114.114.114 53
192.168.56.101 55368 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 60215 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 50534 224.0.0.252 5355
192.168.56.101 51378 224.0.0.252 5355
192.168.56.101 51808 224.0.0.252 5355
192.168.56.101 51963 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 49236 239.255.255.250 3702
192.168.56.101 56542 239.255.255.250 1900
192.168.56.101 58707 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.