4.6
中危
1 个模型检测该样本为恶意！
重新分析
更多

3ceac6be41c42facf52dcff5acb1303a8438804a2ab0c8a0b5501a559cdf42a8

9c249864950be38da04ddfb9553693de.exe

分析耗时

141s

最近分析

文件大小

17.8MB
静态报毒 动态报毒 HIGH SCORE
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
查杀引擎 查杀结果 查杀时间 查杀版本
McAfee 20181124 6.0.6.653
Alibaba 20180921 0.1.0.2
Baidu 20181123 1.0.0.2
Avast 20181124 18.4.3895.0
Kingsoft 20181124 2013.8.14.323
Tencent 20181124 1.0.0.1
CrowdStrike 20181022 1.0
静态指标
Checks if process is being debugged by a debugger (3 个事件)
Time & API Arguments Status Return Repeated
1621010932.032126
IsDebuggerPresent
failed 0 0
1621010932.095126
IsDebuggerPresent
failed 0 0
1621010932.704126
IsDebuggerPresent
failed 0 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1621010932.470126
GlobalMemoryStatusEx
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\mvu8BB0.tmp\pxplay.exe
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\mvu8BB0.tmp\pxplay.exe
File has been identified by one AntiVirus engine on VirusTotal as malicious (1 个事件)
Trapmine malicious.high.ml.score
网络通信
Communicates with host for which no DNS query was performed (1 个事件)
host 217.69.139.110
Installs an hook procedure to monitor for mouse events (1 个事件)
Time & API Arguments Status Return Repeated
1621010934.173126
SetWindowsHookExW
thread_identifier: 0
callback_function: 0x73cfb5cc
module_address: 0x73cf0000
hook_identifier: 14 (WH_MOUSE_LL)
success 3015057 0
Creates a windows hook that monitors keyboard input (keylogger) (1 个事件)
Time & API Arguments Status Return Repeated
1621010934.735126
SetWindowsHookExA
thread_identifier: 0
callback_function: 0x006ef2c0
module_address: 0x00400000
hook_identifier: 13 (WH_KEYBOARD_LL)
success 131519 0
Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)
dead_host 172.217.24.14:443
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2008-11-12 23:45:08

Imports

Library USER32.dll:
• 0x40d174 GetSystemMetrics
• 0x40d178 LoadIconA
• 0x40d17c LoadCursorA
• 0x40d180 RegisterClassA
• 0x40d184 CreateWindowExA
• 0x40d188 SendMessageA
• 0x40d18c DestroyWindow
• 0x40d190 MessageBoxA
• 0x40d194 DefWindowProcA
• 0x40d198 BeginPaint
• 0x40d19c GetClientRect
• 0x40d1a0 LoadImageA
• 0x40d1a4 DrawTextA
• 0x40d1a8 EndPaint
• 0x40d1ac GetSysColor
• 0x40d1b0 FillRect
• 0x40d1b4 SetTimer
• 0x40d1b8 PeekMessageA
• 0x40d1bc TranslateMessage
• 0x40d1c0 DispatchMessageA
• 0x40d1c4 GetForegroundWindow
• 0x40d1c8 ShowWindow
• 0x40d1cc WaitMessage
• 0x40d1d0 KillTimer
• 0x40d1d4 PostQuitMessage
• 0x40d1d8 InvalidateRect
• 0x40d1dc UpdateWindow
• 0x40d1e0 wsprintfA
Library GDI32.dll:
• 0x40d000 GetObjectA
• 0x40d004 CreateCompatibleDC
• 0x40d008 SelectObject
• 0x40d00c SetTextColor
• 0x40d010 SetBkMode
• 0x40d014 DeleteObject
• 0x40d01c GetStockObject
• 0x40d020 SetTextAlign
• 0x40d024 BitBlt
• 0x40d028 DeleteDC
• 0x40d02c CreateSolidBrush
• 0x40d030 CreateFontIndirectA
Library KERNEL32.dll:
• 0x40d038 GetStringTypeW
• 0x40d03c GetStringTypeA
• 0x40d040 MultiByteToWideChar
• 0x40d044 LoadLibraryA
• 0x40d048 GetOEMCP
• 0x40d04c LCMapStringA
• 0x40d050 GetCPInfo
• 0x40d054 FlushFileBuffers
• 0x40d058 SetStdHandle
• 0x40d064 LCMapStringW
• 0x40d068 SetEndOfFile
• 0x40d06c GetACP
• 0x40d070 GetStartupInfoA
• 0x40d074 _lcreat
• 0x40d078 GlobalLock
• 0x40d07c GlobalAlloc
• 0x40d080 GlobalUnlock
• 0x40d084 GlobalHandle
• 0x40d088 GlobalFree
• 0x40d08c _llseek
• 0x40d090 _lread
• 0x40d094 GetTempFileNameA
• 0x40d098 GetTempPathA
• 0x40d09c _lclose
• 0x40d0a0 _lwrite
• 0x40d0a4 CloseHandle
• 0x40d0a8 GetLastError
• 0x40d0ac CreateFileA
• 0x40d0b0 DeleteFileA
• 0x40d0b4 WinExec
• 0x40d0b8 lstrcpyA
• 0x40d0bc _lopen
• 0x40d0c0 LockResource
• 0x40d0c4 LoadResource
• 0x40d0c8 FindResourceA
• 0x40d0cc GetModuleFileNameA
• 0x40d0d0 RemoveDirectoryA
• 0x40d0d4 CreateDirectoryA
• 0x40d0d8 GetModuleHandleA
• 0x40d0dc GetCommandLineA
• 0x40d0e0 GetVersion
• 0x40d0e4 ExitProcess
• 0x40d0e8 HeapAlloc
• 0x40d0ec HeapFree
• 0x40d0f0 GetProcAddress
• 0x40d0fc SetFilePointer
• 0x40d100 ReadFile
• 0x40d108 TerminateProcess
• 0x40d10c GetCurrentProcess
• 0x40d11c WideCharToMultiByte
• 0x40d128 SetHandleCount
• 0x40d12c GetStdHandle
• 0x40d130 GetFileType
• 0x40d138 GetCurrentThreadId
• 0x40d13c TlsSetValue
• 0x40d140 TlsAlloc
• 0x40d144 SetLastError
• 0x40d148 TlsGetValue
• 0x40d150 GetVersionExA
• 0x40d154 HeapDestroy
• 0x40d158 HeapCreate
• 0x40d15c VirtualFree
• 0x40d160 RtlUnwind
• 0x40d164 WriteFile
• 0x40d168 VirtualAlloc
• 0x40d16c HeapReAlloc

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
217.69.139.110 443 192.168.56.101 49182

UDP

Source Source Port Destination Destination Port
192.168.56.101 50002 114.114.114.114 53
192.168.56.101 51378 114.114.114.114 53
192.168.56.101 53237 114.114.114.114 53
192.168.56.101 57874 114.114.114.114 53
192.168.56.101 63497 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 123 20.189.79.72 time.windows.com 123
192.168.56.101 53657 224.0.0.252 5355
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56539 224.0.0.252 5355
192.168.56.101 58367 224.0.0.252 5355
192.168.56.101 60123 224.0.0.252 5355
192.168.56.101 60215 224.0.0.252 5355
192.168.56.101 62318 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 50003 239.255.255.250 3702
192.168.56.101 51379 239.255.255.250 3702
192.168.56.101 51381 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.