SmartHawk

4.6

中危

该样本未表现出任何异常！

重新分析

下载样本

9f37bbf9ccdebdb8e985b4105a4bf7472d210d041c864cf7e6d200b6e67b7ad1

9bdd56b0c2705931fb6916a4b583b684.exe

分析耗时

97s

最近分析

文件大小

531.3KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620808819.906875 GlobalMemoryStatusEx		success	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.ndata

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620808820.421875 NtProtectVirtualMemory	process_identifier: 1752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x636c7000	success	0	0

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (4 个事件)

Time & API	Arguments	Status	Return
1620808822.765875 GetDiskFreeSpaceExW	root_path: C:\Program Files\IceFact free_bytes_available: 1275605418398 total_number_of_free_bytes: 1172526071808 total_number_of_bytes: 30064771072	failed	0
1620808822.765875 GetDiskFreeSpaceExW	root_path: C:\Program Files\ free_bytes_available: 19607846912 total_number_of_free_bytes: 19607846912 total_number_of_bytes: 34252779520	success	1
1620808822.921875 GetDiskFreeSpaceExW	root_path: C:\Program Files\IceFact free_bytes_available: 8446517898753143052 total_number_of_free_bytes: 2683144 total_number_of_bytes: 11524067270197662	failed	0
1620808822.921875 GetDiskFreeSpaceExW	root_path: C:\Program Files\ free_bytes_available: 19607846912 total_number_of_free_bytes: 19607846912 total_number_of_bytes: 34252779520	success	1

Creates executable files on the filesystem (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nshA46A.tmp\System.dll

Drops an executable to the user AppData folder (1 个事件)

file	C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\nshA46A.tmp\System.dll

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.228370083996199

section

{'size_of_data': '0x00007000', 'virtual_address': '0x0000b000', 'entropy': 7.228370083996199, 'name': '.rdata', 'virtual_size': '0x00006e70'}

description

A section with a high entropy has been found

entropy

0.3218390804597701

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (3 个事件)

host	172.217.24.14
host	203.208.41.65
host	203.208.41.98

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.110:443
dead_host	216.58.200.46:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2017-03-29 19:05:43

Imports

Library ADVAPI32.dll:

• 0x438338 AdjustTokenPrivileges

• 0x43833c LookupPrivilegeValueA

• 0x438340 OpenProcessToken

• 0x438344 RegCloseKey

• 0x438348 RegCreateKeyExA

• 0x43834c RegDeleteKeyA

• 0x438350 RegDeleteValueA

• 0x438354 RegEnumKeyA

• 0x438358 RegEnumValueA

• 0x43835c RegOpenKeyExA

• 0x438360 RegQueryValueExA

• 0x438364 RegSetValueExA

• 0x438368 SetFileSecurityA

Library COMCTL32.DLL:

• 0x438370 ImageList_AddMasked

• 0x438374 ImageList_Create

• 0x438378 ImageList_Destroy

• 0x43837c InitCommonControls

Library GDI32.dll:

• 0x438384 CreateBrushIndirect

• 0x438388 CreateFontIndirectA

• 0x43838c DeleteObject

• 0x438390 GetDeviceCaps

• 0x438394 SelectObject

• 0x438398 SetBkColor

• 0x43839c SetBkMode

• 0x4383a0 SetTextColor

Library KERNEL32.dll:

• 0x4383a8 CloseHandle

• 0x4383ac CompareFileTime

• 0x4383b0 CopyFileA

• 0x4383b4 CreateDirectoryA

• 0x4383b8 CreateFileA

• 0x4383bc CreateProcessA

• 0x4383c0 CreateThread

• 0x4383c4 DeleteFileA

• 0x4383c8 ExitProcess

• 0x4383cc ExpandEnvironmentStringsA

• 0x4383d0 FindClose

• 0x4383d4 FindFirstFileA

• 0x4383d8 FindNextFileA

• 0x4383dc FreeLibrary

• 0x4383e0 GetCommandLineA

• 0x4383e4 GetCurrentProcess

• 0x4383e8 GetDiskFreeSpaceA

• 0x4383ec GetExitCodeProcess

• 0x4383f0 GetFileAttributesA

• 0x4383f4 GetFileSize

• 0x4383f8 GetFullPathNameA

• 0x4383fc GetLastError

• 0x438400 GetModuleFileNameA

• 0x438404 GetModuleHandleA

• 0x438408 GetPrivateProfileStringA

• 0x43840c GetProcAddress

• 0x438410 GetShortPathNameA

• 0x438414 GetSystemDirectoryA

• 0x438418 GetTempFileNameA

• 0x43841c GetTempPathA

• 0x438420 GetTickCount

• 0x438424 GetVersion

• 0x438428 GetWindowsDirectoryA

• 0x43842c GlobalAlloc

• 0x438430 GlobalFree

• 0x438434 GlobalLock

• 0x438438 GlobalUnlock

• 0x43843c LoadLibraryExA

• 0x438440 MoveFileA

• 0x438444 MoveFileExA

• 0x438448 MulDiv

• 0x43844c MultiByteToWideChar

• 0x438450 ReadFile

• 0x438454 RemoveDirectoryA

• 0x438458 SearchPathA

• 0x43845c SetCurrentDirectoryA

• 0x438460 SetEnvironmentVariableA

• 0x438464 SetErrorMode

• 0x438468 SetFileAttributesA

• 0x43846c SetFilePointer

• 0x438470 SetFileTime

• 0x438474 Sleep

• 0x438478 WaitForSingleObject

• 0x43847c WriteFile

• 0x438480 WritePrivateProfileStringA

• 0x438484 lstrcatA

• 0x438488 lstrcmpA

• 0x43848c lstrcmpiA

• 0x438490 lstrcpyA

• 0x438494 lstrcpynA

• 0x438498 lstrlenA

Library ole32.dll:

• 0x4384a0 CoCreateInstance

• 0x4384a4 CoTaskMemFree

• 0x4384a8 OleInitialize

• 0x4384ac OleUninitialize

Library SHELL32.dll:

• 0x4384b4 SHBrowseForFolderA

• 0x4384b8 SHFileOperationA

• 0x4384bc SHGetFileInfoA

• 0x4384c0 SHGetPathFromIDListA

• 0x4384c4 SHGetSpecialFolderLocation

• 0x4384c8 ShellExecuteA

Library USER32.dll:

• 0x4384d0 AppendMenuA

• 0x4384d4 BeginPaint

• 0x4384d8 CallWindowProcA

• 0x4384dc CharNextA

• 0x4384e0 CharPrevA

• 0x4384e4 CheckDlgButton

• 0x4384e8 CloseClipboard

• 0x4384ec CreateDialogParamA

• 0x4384f0 CreatePopupMenu

• 0x4384f4 CreateWindowExA

• 0x4384f8 DefWindowProcA

• 0x4384fc DestroyWindow

• 0x438500 DialogBoxParamA

• 0x438504 DispatchMessageA

• 0x438508 DrawTextA

• 0x43850c EmptyClipboard

• 0x438510 EnableMenuItem

• 0x438514 EnableWindow

• 0x438518 EndDialog

• 0x43851c EndPaint

• 0x438520 ExitWindowsEx

• 0x438524 FillRect

• 0x438528 FindWindowExA

• 0x43852c GetClassInfoA

• 0x438530 GetClientRect

• 0x438534 GetDC

• 0x438538 GetDlgItem

• 0x43853c GetDlgItemTextA

• 0x438540 GetMessagePos

• 0x438544 GetSysColor

• 0x438548 GetSystemMenu

• 0x43854c GetSystemMetrics

• 0x438550 GetWindowLongA

• 0x438554 GetWindowRect

• 0x438558 InvalidateRect

• 0x43855c IsWindow

• 0x438560 IsWindowEnabled

• 0x438564 IsWindowVisible

• 0x438568 LoadBitmapA

• 0x43856c LoadCursorA

• 0x438570 LoadImageA

• 0x438574 MessageBoxIndirectA

• 0x438578 OpenClipboard

• 0x43857c PeekMessageA

• 0x438580 PostQuitMessage

• 0x438584 RegisterClassA

• 0x438588 ReleaseDC

• 0x43858c ScreenToClient

• 0x438590 SendMessageA

• 0x438594 SendMessageTimeoutA

• 0x438598 SetClassLongA

• 0x43859c SetClipboardData

• 0x4385a0 SetCursor

• 0x4385a4 SetDlgItemTextA

• 0x4385a8 SetForegroundWindow

• 0x4385ac SetTimer

• 0x4385b0 SetWindowLongA

• 0x4385b4 SetWindowPos

• 0x4385b8 SetWindowTextA

• 0x4385bc ShowWindow

• 0x4385c0 SystemParametersInfoA

• 0x4385c4 TrackPopupMenu

• 0x4385c8 wsprintfA

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 216.58.200.46 CNAME clients.l.google.com A 172.217.160.110	216.58.200.238
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.