SmartHawk

2.6

中危

该样本未表现出任何异常！

重新分析

下载样本

a0be06f2bac6d8bf23e74f8dd262ef7df4803f20a43b70fbfde0a220df52636c

9d523c5f482b6b042d0d913bff5ef847.exe

分析耗时

96s

Time & API	Arguments	Status	Return	Repeated
1621018156.12002 NtAllocateVirtualMemory	process_identifier: 1424 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 4096 (MEM_COMMIT) base_address: 0x0000000004140000	success	0	0

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2017-02-13 18:42:26

Imports

Library KERNEL32.dll:

• 0x477070 GetCurrentThreadId

• 0x477074 GetCurrentProcessId

• 0x477078 OpenFileMappingA

• 0x47707c lstrcpyA

• 0x477080 FreeLibrary

• 0x477084 CreateDirectoryW

• 0x477088 LoadLibraryW

• 0x47708c CreateFileW

• 0x477090 MultiByteToWideChar

• 0x477094 GetProcAddress

• 0x477098 LocalFree

• 0x47709c lstrcpynA

• 0x4770a0 GetFileAttributesA

• 0x4770a4 lstrcpynW

• 0x4770a8 GetFileAttributesW

• 0x4770ac GetModuleFileNameW

• 0x4770b0 lstrlenW

• 0x4770b4 CreateDirectoryA

• 0x4770b8 FindFirstFileA

• 0x4770bc FindClose

• 0x4770c0 GetModuleFileNameA

• 0x4770c4 FindNextFileA

• 0x4770c8 WideCharToMultiByte

• 0x4770cc CreateProcessW

• 0x4770d0 SetUnhandledExceptionFilter

• 0x4770d4 OpenProcess

• 0x4770d8 CreateProcessA

• 0x4770dc RemoveDirectoryA

• 0x4770e0 CopyFileA

• 0x4770e4 GetTempFileNameA

• 0x4770e8 GetModuleHandleA

• 0x4770ec GetTempPathA

• 0x4770f0 DeleteFileA

• 0x4770f4 GetComputerNameA

• 0x4770f8 FormatMessageA

• 0x4770fc GetVolumePathNameW

• 0x477100 CopyFileW

• 0x477104 FormatMessageW

• 0x477108 RemoveDirectoryW

• 0x47710c ReleaseMutex

• 0x477110 GetDiskFreeSpaceExA

• 0x477114 GetVersionExA

• 0x477118 DeleteFileW

• 0x47711c SetFileAttributesW

• 0x477120 CreatePipe

• 0x477124 GetExitCodeThread

• 0x477128 WaitForMultipleObjects

• 0x47712c InterlockedExchangeAdd

• 0x477130 MoveFileA

• 0x477134 GetPrivateProfileStringW

• 0x477138 LoadLibraryA

• 0x47713c CreateMutexA

• 0x477140 GetDriveTypeA

• 0x477144 GetVolumeInformationA

• 0x477148 DeviceIoControl

• 0x47714c ResetEvent

• 0x477150 MoveFileExA

• 0x477154 Process32First

• 0x477158 TerminateProcess

• 0x47715c GetSystemDirectoryA

• 0x477160 GetLocalTime

• 0x477164 Process32Next

• 0x477168 CreateToolhelp32Snapshot

• 0x47716c OutputDebugStringW

• 0x477170 QueueUserWorkItem

• 0x477174 ReleaseSemaphore

• 0x477178 GetLogicalDriveStringsA

• 0x47717c GlobalMemoryStatusEx

• 0x477180 GetSystemInfo

• 0x477184 GetCurrentThread

• 0x477188 SetThreadPriority

• 0x47718c GetThreadTimes

• 0x477190 UnregisterWaitEx

• 0x477194 VirtualProtect

• 0x477198 VirtualFree

• 0x47719c VirtualAlloc

• 0x4771a0 GetVersionExW

• 0x4771a4 FreeLibraryAndExitThread

• 0x4771a8 QueryDepthSList

• 0x4771ac UnregisterWait

• 0x4771b0 RegisterWaitForSingleObject

• 0x4771b4 SetThreadAffinityMask

• 0x4771b8 GetProcessAffinityMask

• 0x4771bc GetNumaHighestNodeNumber

• 0x4771c0 DeleteTimerQueueTimer

• 0x4771c4 ChangeTimerQueueTimer

• 0x4771c8 CreateTimerQueueTimer

• 0x4771cc GetLogicalProcessorInformation

• 0x4771d0 GetThreadPriority

• 0x4771d4 SwitchToThread

• 0x4771d8 SignalObjectAndWait

• 0x4771dc WaitForSingleObjectEx

• 0x4771e0 CreateTimerQueue

• 0x4771e4 DuplicateHandle

• 0x4771e8 SetEndOfFile

• 0x4771ec GetFullPathNameW

• 0x4771f0 PeekNamedPipe

• 0x4771f4 GetFileInformationByHandle

• 0x4771f8 FileTimeToLocalFileTime

• 0x4771fc SetStdHandle

• 0x477200 GetStringTypeW

• 0x477204 EnumSystemLocalesW

• 0x477208 GetUserDefaultLCID

• 0x47720c IsValidLocale

• 0x477210 GetLocaleInfoW

• 0x477214 LCMapStringW

• 0x477218 CompareStringW

• 0x47721c GetCurrentDirectoryW

• 0x477220 GetConsoleCP

• 0x477224 FlushFileBuffers

• 0x477228 FileTimeToSystemTime

• 0x47722c SystemTimeToTzSpecificLocalTime

• 0x477230 FindFirstFileExW

• 0x477234 FreeEnvironmentStringsW

• 0x477238 GetEnvironmentStringsW

• 0x47723c QueryPerformanceCounter

• 0x477240 SetFilePointerEx

• 0x477244 ReadConsoleW

• 0x477248 GetConsoleMode

• 0x47724c GetTimeZoneInformation

• 0x477250 CreateSemaphoreW

• 0x477254 GetModuleHandleW

• 0x477258 GetTickCount

• 0x47725c GetStartupInfoW

• 0x477260 TlsFree

• 0x477264 CreateFileMappingA

• 0x477268 lstrcmpiA

• 0x47726c InterlockedExchange

• 0x477270 lstrcatA

• 0x477274 Sleep

• 0x477278 InterlockedCompareExchange

• 0x47727c InterlockedDecrement

• 0x477280 UnmapViewOfFile

• 0x477284 InterlockedIncrement

• 0x477288 MapViewOfFile

• 0x47728c lstrlenA

• 0x477290 GetFileSize

• 0x477294 InterlockedPushEntrySList

• 0x477298 InterlockedFlushSList

• 0x47729c InterlockedPopEntrySList

• 0x4772a0 InitializeSListHead

• 0x4772a4 CloseHandle

• 0x4772a8 ReadFile

• 0x4772ac WriteFile

• 0x4772b0 SetFilePointer

• 0x4772b4 CreateFileA

• 0x4772b8 CreateThread

• 0x4772bc OutputDebugStringA

• 0x4772c0 GetLastError

• 0x4772c4 CreateEventA

• 0x4772c8 SetEvent

• 0x4772cc CreateSemaphoreA

• 0x4772d0 WaitForSingleObject

• 0x4772d4 TlsSetValue

• 0x4772d8 TlsGetValue

• 0x4772dc TlsAlloc

• 0x4772e0 GetCurrentProcess

• 0x4772e4 CreateEventW

• 0x4772e8 InitializeCriticalSectionAndSpinCount

• 0x4772ec UnhandledExceptionFilter

• 0x4772f0 DeleteCriticalSection

• 0x4772f4 GetCPInfo

• 0x4772f8 GetOEMCP

• 0x4772fc GetACP

• 0x477300 IsValidCodePage

• 0x477304 IsDebuggerPresent

• 0x477308 SetLastError

• 0x47730c HeapSize

• 0x477310 GetProcessHeap

• 0x477314 IsProcessorFeaturePresent

• 0x477318 WriteConsoleW

• 0x47731c GetFileType

• 0x477320 GetStdHandle

• 0x477324 RtlUnwind

• 0x477328 RaiseException

• 0x47732c GetCurrentDirectoryA

• 0x477330 SetCurrentDirectoryA

• 0x477334 SetEnvironmentVariableA

• 0x477338 GetFullPathNameA

• 0x47733c GetDriveTypeW

• 0x477340 GetCommandLineA

• 0x477344 LeaveCriticalSection

• 0x477348 EnterCriticalSection

• 0x47734c HeapReAlloc

• 0x477350 LoadLibraryExW

• 0x477354 ExitThread

• 0x477358 GetSystemTimeAsFileTime

• 0x47735c AreFileApisANSI

• 0x477360 GetModuleHandleExW

• 0x477364 ExitProcess

• 0x477368 HeapAlloc

• 0x47736c DecodePointer

• 0x477370 EncodePointer

• 0x477374 HeapFree

Library USER32.dll:

• 0x477410 SetWindowLongA

• 0x477414 GetWindowLongW

• 0x477418 AppendMenuW

• 0x47741c ReleaseDC

• 0x477420 OffsetRect

• 0x477424 ChildWindowFromPoint

• 0x477428 SetWindowLongW

• 0x47742c IsDialogMessageA

• 0x477430 PeekMessageA

• 0x477434 wsprintfA

• 0x477438 SendMessageA

• 0x47743c GetClientRect

• 0x477440 IsWindowEnabled

• 0x477444 LoadIconA

• 0x477448 SetForegroundWindow

• 0x47744c GetWindowDC

• 0x477450 TrackPopupMenu

• 0x477454 SetWindowPos

• 0x477458 GetCursorPos

• 0x47745c SetLayeredWindowAttributes

• 0x477460 CreatePopupMenu

• 0x477464 CreateWindowExW

• 0x477468 DispatchMessageA

• 0x47746c MessageBoxW

• 0x477470 RegisterClassW

• 0x477474 GetSystemMetrics

• 0x477478 IsWindowVisible

• 0x47747c LoadImageA

• 0x477480 MapWindowPoints

• 0x477484 UpdateWindow

• 0x477488 PostThreadMessageA

• 0x47748c GetMessageA

• 0x477490 InvalidateRect

• 0x477494 wsprintfW

• 0x477498 CopyRect

• 0x47749c SetFocus

• 0x4774a0 MessageBoxA

• 0x4774a4 SetWindowTextA

• 0x4774a8 GetWindowRect

• 0x4774ac PostMessageA

• 0x4774b0 RegisterClassA

• 0x4774b4 ShowWindow

• 0x4774b8 DefWindowProcA

• 0x4774bc EnableWindow

• 0x4774c0 AdjustWindowRect

• 0x4774c4 LoadCursorA

• 0x4774c8 GetDlgCtrlID

• 0x4774cc DefWindowProcW

• 0x4774d0 MoveWindow

• 0x4774d4 FlashWindowEx

• 0x4774d8 TranslateMessage

• 0x4774dc GetActiveWindow

• 0x4774e0 wvsprintfA

• 0x4774e4 DestroyWindow

• 0x4774e8 CreateWindowExA

Library GDI32.dll:

• 0x47704c DeleteDC

• 0x477050 CreateDIBSection

• 0x477054 GetDIBits

• 0x477058 DeleteObject

• 0x47705c SelectObject

• 0x477060 CreateCompatibleDC

• 0x477064 GetStockObject

• 0x477068 BitBlt

Library ADVAPI32.dll:

• 0x477000 OpenSCManagerA

• 0x477004 CloseServiceHandle

• 0x477008 OpenServiceA

• 0x47700c RegSetValueExW

• 0x477010 RegOpenKeyExW

• 0x477014 RegQueryValueExW

• 0x477018 RegSetValueW

• 0x47701c RegSetValueA

• 0x477020 RegQueryValueW

• 0x477024 RegCloseKey

• 0x477028 GetUserNameA

• 0x47702c RegOpenKeyExA

• 0x477030 RegCreateKeyExA

• 0x477034 RegQueryValueExA

• 0x477038 RegSetValueExA

• 0x47703c FreeSid

• 0x477040 SetEntriesInAclW

• 0x477044 RegEnumKeyW

Library SHELL32.dll:

• 0x4773c4 SHGetMalloc

• 0x4773c8 SHGetSpecialFolderLocation

• 0x4773cc ShellExecuteA

• 0x4773d0 SHGetPathFromIDListW

• 0x4773d4 SHGetFolderPathW

• 0x4773d8 Shell_NotifyIconA

• 0x4773dc SHGetSpecialFolderPathA

• 0x4773e0 SHChangeNotify

Library ole32.dll:

• 0x47758c StringFromIID

• 0x477590 CoTaskMemFree

• 0x477594 CLSIDFromProgID

• 0x477598 OleSetContainedObject

• 0x47759c OleCreate

• 0x4775a0 OleUninitialize

• 0x4775a4 CoCreateInstance

• 0x4775a8 CoCreateGuid

• 0x4775ac CoTaskMemAlloc

• 0x4775b0 CoSetProxyBlanket

• 0x4775b4 CoUninitialize

• 0x4775b8 CoInitialize

• 0x4775bc OleInitialize

Library OLEAUT32.dll:

• 0x477388 VariantTimeToSystemTime

• 0x47738c VariantCopy

• 0x477390 VariantChangeType

• 0x477394 SysStringLen

• 0x477398 SysAllocString

• 0x47739c SysAllocStringLen

• 0x4773a0 SysFreeString

• 0x4773a4 VariantClear

• 0x4773a8 SafeArrayCreateVector

• 0x4773ac SafeArrayAccessData

• 0x4773b0 VariantInit

• 0x4773b4 SafeArrayUnaccessData

Library WSOCK32.dll:

• 0x477544 gethostbyname

• 0x477548 send

• 0x47754c WSAStartup

• 0x477550 WSACleanup

• 0x477554 closesocket

• 0x477558 socket

• 0x47755c htons

• 0x477560 inet_addr

• 0x477564 htonl

• 0x477568 WSAGetLastError

• 0x47756c ntohs

• 0x477570 getservbyport

• 0x477574 getservbyname

• 0x477578 WSASetLastError

• 0x47757c gethostbyaddr

• 0x477580 connect

• 0x477584 ioctlsocket

Library WS2_32.dll:

• 0x47753c WSAAddressToStringA

Library WININET.dll:

• 0x477500 InternetReadFile

• 0x477504 HttpSendRequestA

• 0x477508 InternetCrackUrlA

• 0x47750c InternetGetLastResponseInfoA

• 0x477510 InternetConnectA

• 0x477514 HttpOpenRequestA

• 0x477518 InternetSetOptionA

• 0x47751c InternetOpenUrlW

• 0x477520 InternetOpenW

• 0x477524 InternetCrackUrlW

• 0x477528 InternetOpenUrlA

• 0x47752c HttpQueryInfoA

• 0x477530 InternetCloseHandle

• 0x477534 InternetOpenA

Library SHLWAPI.dll:

• 0x4773e8 StrStrA

• 0x4773ec PathAppendW

• 0x4773f0 PathCanonicalizeW

• 0x4773f4 SHDeleteKeyA

• 0x4773f8 PathAppendA

• 0x4773fc PathCanonicalizeA

• 0x477400 PathFileExistsA

• 0x477404 UrlCombineA

• 0x477408 PathFindFileNameA

Library NETAPI32.dll:

• 0x47737c NetWkstaGetInfo

• 0x477380 NetApiBufferFree

Library PSAPI.DLL:

• 0x4773bc GetModuleFileNameExA

Library VERSION.dll:

• 0x4774f0 GetFileVersionInfoSizeA

• 0x4774f4 GetFileVersionInfoA

• 0x4774f8 VerQueryValueA

Library urlmon.dll:

• 0x4775c4 CoInternetGetSession

Exports

Ordinal	Address	Name
1	0x4291bb	?CreateDefaultBrowserInfo@@YGPAVIDefaultBrowserInfo@@XZ
2	0x42921b	?CreateDirectXVersionInfo@@YGPAVIDirectXVersionInfo@@XZ
3	0x429161	?CreateDisplaysDeviceInfo@@YGPAVIDisplayDevicesInfo@@XZ
4	0x4290fb	?CreateFixedDriveInfo@@YGPAVIFixedDriveInfo@@XZ
5	0x429125	?CreateFixedDrivesInfo@@YGPAVIFixedDrivesInfo@@XZ
6	0x4291d1	?CreateFlashInfo@@YGPAVIFlashInfo@@XZ
7	0x42919d	?CreateIEVersionInfo@@YGPAVIIEVersionInfo@@XZ
8	0x429239	?CreateMacAddress@@YGPAVIMacAddress@@XZ
9	0x429257	?CreateMachineInfo@@YGPAVIMachineInfo@@XZ
10	0x4299d0	?CreateMachineInfoXML@@YGPAVIMachineInfoXML@@XZ

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
clients2.google.com	CNAME clients.l.google.com A 216.58.200.238	216.58.200.238
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
stiekehelp.gameassists.co.uk	A 78.24.213.153	78.24.213.153
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	51808	114.114.114.114	53
192.168.56.101	53237	114.114.114.114	53
192.168.56.101	57756	114.114.114.114	53
192.168.56.101	57874	114.114.114.114	53
192.168.56.101	60384	114.114.114.114	53
192.168.56.101	62318	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	49235	224.0.0.252	5355
192.168.56.101	49713	224.0.0.252	5355
192.168.56.101	51378	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	58367	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	63429	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	51966	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.