SmartHawk

3.6

中危

该样本未表现出任何异常！

重新分析

下载样本

e390ab08f852845fccc07d234a96f51fcb23a95a4fa872a22b48afa0cbb0941e

9f00d78f2e8e4523773a264f85be1c02.exe

分析耗时

44s

最近分析

文件大小

379.2KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

Checks if process is being debugged by a debugger (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620808821.952625 IsDebuggerPresent		failed	0	0

This executable is signed

The file contains an unknown PE resource name possibly indicative of a packer (1 个事件)

resource name

None

One or more processes crashed (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620808835.890625 __exception__	stacktrace: registers.r14: 1241826 registers.r9: 818 registers.rcx: 2007171072 registers.rsi: 38849856 registers.r10: 3221225715 registers.rbx: 0 registers.rdi: 2007171072 registers.r11: 1240576 registers.r8: 260 registers.rdx: 1240576 registers.rbp: 1240464 registers.r15: 3978066816 registers.r12: 0 registers.rsp: 1240200 registers.rax: 0 registers.r13: 2 exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0	success	0	0

Allocates read-write-execute memory (usually to unpack itself) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620808835.483625 NtAllocateVirtualMemory	process_identifier: 2856 region_size: 196608 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffffffffffff allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) base_address: 0x0000000001fd0000	success	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620808835.718625 NtProtectVirtualMemory	process_identifier: 2856 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 131072 protection: 32 (PAGE_EXECUTE_READ) process_handle: 0xffffffffffffffff base_address: 0x00000000024e1000	success	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.720947833034582

section

{'size_of_data': '0x0003e800', 'virtual_address': '0x00023000', 'entropy': 7.720947833034582, 'name': '.rsrc', 'virtual_size': '0x0003e6a0'}

description

A section with a high entropy has been found

entropy

0.6693440428380187

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 个事件)

dead_host

172.217.160.110:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2020-09-10 01:16:04

Imports

Library KERNEL32.dll:

• 0x14001e050 CreateThread

• 0x14001e058 TerminateThread

• 0x14001e060 GetExitCodeThread

• 0x14001e068 GetProcAddress

• 0x14001e070 VirtualAlloc

• 0x14001e078 CreateDirectoryW

• 0x14001e080 ReadFile

• 0x14001e088 SetFilePointerEx

• 0x14001e090 WriteFile

• 0x14001e098 GetCurrentProcessId

• 0x14001e0a0 ExitProcess

• 0x14001e0a8 GetTickCount

• 0x14001e0b0 QueryPerformanceCounter

• 0x14001e0b8 RtlCaptureContext

• 0x14001e0c0 RtlLookupFunctionEntry

• 0x14001e0c8 RtlVirtualUnwind

• 0x14001e0d0 IsDebuggerPresent

• 0x14001e0d8 SetUnhandledExceptionFilter

• 0x14001e0e0 UnhandledExceptionFilter

• 0x14001e0e8 GetCurrentProcess

• 0x14001e0f0 TerminateProcess

• 0x14001e0f8 GetStartupInfoA

• 0x14001e100 Sleep

• 0x14001e108 FindResourceA

• 0x14001e110 LoadResource

• 0x14001e118 SizeofResource

• 0x14001e120 CreateFileW

• 0x14001e128 CloseHandle

• 0x14001e130 GlobalAlloc

• 0x14001e138 GetModuleHandleW

• 0x14001e140 lstrcpynW

• 0x14001e148 GetCurrentThreadId

• 0x14001e150 GlobalFree

• 0x14001e158 GetSystemTimeAsFileTime

Library USER32.dll:

• 0x14001e298 ClientToScreen

• 0x14001e2a0 ReleaseCapture

• 0x14001e2a8 SetCapture

• 0x14001e2b0 SetFocus

• 0x14001e2b8 SetCursor

• 0x14001e2c0 LoadCursorW

• 0x14001e2c8 CallWindowProcW

• 0x14001e2d0 EndPaint

• 0x14001e2d8 BeginPaint

• 0x14001e2e0 DestroyCursor

• 0x14001e2e8 SendDlgItemMessageW

• 0x14001e2f0 SetDlgItemTextW

• 0x14001e2f8 EndDialog

• 0x14001e300 GetDlgItemTextW

• 0x14001e308 MessageBoxW

• 0x14001e310 EnableWindow

• 0x14001e318 ShowWindow

• 0x14001e320 LoadIconW

• 0x14001e328 DialogBoxParamW

• 0x14001e330 wsprintfW

• 0x14001e338 GetParent

• 0x14001e340 GetDlgItem

• 0x14001e348 SetWindowTextW

• 0x14001e350 IsWindow

• 0x14001e358 GetWindowLongW

• 0x14001e360 CreateCursor

• 0x14001e368 GetWindowRect

• 0x14001e370 PtInRect

• 0x14001e378 InvalidateRect

• 0x14001e380 UpdateWindow

• 0x14001e388 GetDC

• 0x14001e390 ReleaseDC

• 0x14001e398 SetWindowPos

• 0x14001e3a0 GetWindowLongPtrW

• 0x14001e3a8 SendMessageW

• 0x14001e3b0 GetClientRect

• 0x14001e3b8 FillRect

• 0x14001e3c0 GetFocus

• 0x14001e3c8 DrawFocusRect

• 0x14001e3d0 DrawTextW

• 0x14001e3d8 SetWindowLongPtrW

Library GDI32.dll:

• 0x14001e010 GetObjectW

• 0x14001e018 GetStockObject

• 0x14001e020 DeleteObject

• 0x14001e028 CreateFontIndirectW

• 0x14001e030 SetTextColor

• 0x14001e038 SelectObject

• 0x14001e040 SetBkMode

Library COMDLG32.dll:

• 0x14001e000 GetOpenFileNameW

Library SHELL32.dll:

• 0x14001e288 ShellExecuteW

Library MSVCR90.dll:

• 0x14001e168 _decode_pointer

• 0x14001e170 _onexit

• 0x14001e178 _lock

• 0x14001e180 __dllonexit

• 0x14001e188 _unlock

• 0x14001e190 ?terminate@@YAXXZ

• 0x14001e198 __crt_debugger_hook

• 0x14001e1a0 __set_app_type

• 0x14001e1a8 _encode_pointer

• 0x14001e1b0 _fmode

• 0x14001e1b8 _commode

• 0x14001e1c0 __setusermatherr

• 0x14001e1c8 _configthreadlocale

• 0x14001e1d0 _initterm_e

• 0x14001e1d8 _initterm

• 0x14001e1e0 _acmdln

• 0x14001e1e8 exit

• 0x14001e1f0 _cexit

• 0x14001e1f8 _ismbblead

• 0x14001e200 _exit

• 0x14001e208 _XcptFilter

• 0x14001e210 __C_specific_handler

• 0x14001e218 __getmainargs

• 0x14001e220 _amsg_exit

• 0x14001e228 __CxxFrameHandler3

• 0x14001e230 _byteswap_ulong

• 0x14001e238 _byteswap_uint64

• 0x14001e240 ??_U@YAPEAX_K@Z

• 0x14001e248 memset

• 0x14001e250 malloc

• 0x14001e258 wcslen

• 0x14001e260 ??2@YAPEAX_K@Z

• 0x14001e268 ??3@YAXPEAX@Z

• 0x14001e270 free

• 0x14001e278 ??_V@YAXPEAX@Z

Exports

Ordinal	Address	Name
1	0x140002380	ERWQSDASQWAFASASWW

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
teredo.ipv6.microsoft.com
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
clients2.google.com	A 172.217.160.110 CNAME clients.l.google.com	142.250.66.110

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	58367	114.114.114.114	53
192.168.56.101	60123	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51963	224.0.0.252	5355
192.168.56.101	53657	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	49238	239.255.255.250	1900

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.