SmartHawk

3.4

中危

该样本未表现出任何异常！

重新分析

下载样本

2c1608b3bfb5ad3569c1e58fec9aff74cb4230132792db392ac1762ed0f14dd1

9fd963fa04c34bf86085ab6867dd4fad.exe

分析耗时

95s

最近分析

文件大小

6.9MB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

This executable has a PDB path (1 个事件)

pdb_path

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

Allocates read-write-execute memory (usually to unpack itself) (7 个事件)

Time & API	Arguments	Status
1620847991.553125 NtProtectVirtualMemory	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x745e1000	success
1620847991.912125 NtProtectVirtualMemory	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x747a1000	success
1620847992.584125 NtProtectVirtualMemory	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x77711000	success
1620847992.584125 NtProtectVirtualMemory	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76241000	success
1620847992.584125 NtProtectVirtualMemory	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76121000	success
1620847992.881125 NtProtectVirtualMemory	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x75331000	success
1620847992.881125 NtProtectVirtualMemory	process_identifier: 2772 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) process_handle: 0xffffffff base_address: 0x76881000	success

Checks adapter addresses which can be used to detect virtual network interfaces (1 个事件)

Time & API	Arguments	Status	Return	Repeated
1620847993.834125 GetAdaptersAddresses	flags: 0 family: 0	failed	111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 个事件)

entropy

7.260007034688304

section

{'size_of_data': '0x0001c600', 'virtual_address': '0x00026000', 'entropy': 7.260007034688304, 'name': '.rsrc', 'virtual_size': '0x0001c520'}

description

A section with a high entropy has been found

entropy

0.5896103896103896

description

Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (2 个事件)

dead_host	172.217.24.14:443
dead_host	172.217.160.78:443

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2011-02-20 16:19:48

Imports

Library COMCTL32.dll:

• 0x41302c InitCommonControlsEx

• 0x413030

Library SHLWAPI.dll:

• 0x4131bc SHAutoComplete

Library KERNEL32.dll:

• 0x41306c DeleteFileW

• 0x413070 DeleteFileA

• 0x413074 CreateDirectoryA

• 0x413078 CreateDirectoryW

• 0x41307c FindClose

• 0x413080 FindNextFileA

• 0x413084 FindFirstFileA

• 0x413088 FindNextFileW

• 0x41308c FindFirstFileW

• 0x413090 GetTickCount

• 0x413094 WideCharToMultiByte

• 0x413098 GlobalAlloc

• 0x41309c GetVersionExW

• 0x4130a0 GetFullPathNameA

• 0x4130a4 GetFullPathNameW

• 0x4130a8 GetModuleFileNameW

• 0x4130ac FindResourceW

• 0x4130b0 GetModuleHandleW

• 0x4130b4 HeapAlloc

• 0x4130b8 GetProcessHeap

• 0x4130bc HeapFree

• 0x4130c0 HeapReAlloc

• 0x4130c4 CompareStringA

• 0x4130c8 ExitProcess

• 0x4130cc GetLocaleInfoW

• 0x4130d0 GetNumberFormatW

• 0x4130d4 SetFileAttributesW

• 0x4130d8 GetDateFormatW

• 0x4130dc GetTimeFormatW

• 0x4130e0 FileTimeToSystemTime

• 0x4130e4 FileTimeToLocalFileTime

• 0x4130e8 ExpandEnvironmentStringsW

• 0x4130ec WaitForSingleObject

• 0x4130f0 Sleep

• 0x4130f4 GetTempPathW

• 0x4130f8 MoveFileExW

• 0x4130fc UnmapViewOfFile

• 0x413100 GetCommandLineW

• 0x413104 MapViewOfFile

• 0x413108 CreateFileMappingW

• 0x41310c OpenFileMappingW

• 0x413110 SetEnvironmentVariableW

• 0x413114 GetProcAddress

• 0x413118 LocalFileTimeToFileTime

• 0x41311c SystemTimeToFileTime

• 0x413120 GetSystemTime

• 0x413124 MultiByteToWideChar

• 0x413128 CompareStringW

• 0x41312c IsDBCSLeadByte

• 0x413130 GetCPInfo

• 0x413134 SetCurrentDirectoryW

• 0x413138 LoadLibraryW

• 0x41313c FreeLibrary

• 0x413140 SetFileAttributesA

• 0x413144 GetFileAttributesW

• 0x413148 GetFileAttributesA

• 0x41314c WriteFile

• 0x413150 GetStdHandle

• 0x413154 ReadFile

• 0x413158 GetCurrentDirectoryW

• 0x41315c CreateFileW

• 0x413160 CreateFileA

• 0x413164 GetFileType

• 0x413168 SetEndOfFile

• 0x41316c SetFilePointer

• 0x413170 MoveFileW

• 0x413174 SetFileTime

• 0x413178 GetCurrentProcess

• 0x41317c CloseHandle

• 0x413180 SetLastError

• 0x413184 GetLastError

• 0x413188 DosDateTimeToFileTime

Library USER32.dll:

• 0x4131c4 wvsprintfW

• 0x4131c8 ReleaseDC

• 0x4131cc GetDC

• 0x4131d0 SendMessageW

• 0x4131d4 SetDlgItemTextW

• 0x4131d8 SetFocus

• 0x4131dc EndDialog

• 0x4131e0 DestroyIcon

• 0x4131e4 SendDlgItemMessageW

• 0x4131e8 GetDlgItemTextW

• 0x4131ec GetClassNameW

• 0x4131f0 DialogBoxParamW

• 0x4131f4 IsWindowVisible

• 0x4131f8 WaitForInputIdle

• 0x4131fc SetForegroundWindow

• 0x413200 GetSysColor

• 0x413204 PostMessageW

• 0x413208 LoadBitmapW

• 0x41320c LoadIconW

• 0x413210 CharToOemA

• 0x413214 OemToCharA

• 0x413218 FindWindowExW

• 0x41321c wvsprintfA

• 0x413220 GetParent

• 0x413224 MapWindowPoints

• 0x413228 CreateWindowExW

• 0x41322c UpdateWindow

• 0x413230 SetWindowTextW

• 0x413234 LoadCursorW

• 0x413238 RegisterClassExW

• 0x41323c SetWindowLongW

• 0x413240 GetWindowLongW

• 0x413244 DefWindowProcW

• 0x413248 PeekMessageW

• 0x41324c GetMessageW

• 0x413250 TranslateMessage

• 0x413254 DispatchMessageW

• 0x413258 DestroyWindow

• 0x41325c GetClientRect

• 0x413260 IsWindow

• 0x413264 CharToOemBuffW

• 0x413268 MessageBoxW

• 0x41326c ShowWindow

• 0x413270 GetDlgItem

• 0x413274 EnableWindow

• 0x413278 OemToCharBuffA

• 0x41327c CharUpperA

• 0x413280 CharToOemBuffA

• 0x413284 LoadStringW

• 0x413288 SetWindowPos

• 0x41328c GetWindowTextW

• 0x413290 GetSystemMetrics

• 0x413294 GetWindow

• 0x413298 CharUpperW

• 0x41329c GetWindowRect

• 0x4132a0 CopyRect

Library GDI32.dll:

• 0x413048 GetDeviceCaps

• 0x41304c GetObjectW

• 0x413050 CreateCompatibleBitmap

• 0x413054 SelectObject

• 0x413058 StretchBlt

• 0x41305c CreateCompatibleDC

• 0x413060 DeleteObject

• 0x413064 DeleteDC

Library COMDLG32.dll:

• 0x413038 GetOpenFileNameW

• 0x41303c CommDlgExtendedError

• 0x413040 GetSaveFileNameW

Library ADVAPI32.dll:

• 0x413000 RegOpenKeyExW

• 0x413004 LookupPrivilegeValueW

• 0x413008 OpenProcessToken

• 0x41300c RegQueryValueExW

• 0x413010 RegCreateKeyExW

• 0x413014 RegSetValueExW

• 0x413018 RegCloseKey

• 0x41301c SetFileSecurityW

• 0x413020 SetFileSecurityA

• 0x413024 AdjustTokenPrivileges

Library SHELL32.dll:

• 0x413198 SHChangeNotify

• 0x41319c ShellExecuteExW

• 0x4131a0 SHFileOperationW

• 0x4131a4 SHGetFileInfoW

• 0x4131a8 SHGetSpecialFolderLocation

• 0x4131ac SHGetMalloc

• 0x4131b0 SHBrowseForFolderW

• 0x4131b4 SHGetPathFromIDListW

Library ole32.dll:

• 0x4132a8 CreateStreamOnHGlobal

• 0x4132ac OleInitialize

• 0x4132b0 CoCreateInstance

• 0x4132b4 OleUninitialize

• 0x4132b8 CLSIDFromString

Library OLEAUT32.dll:

• 0x413190 VariantInit

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
time.windows.com	A 20.189.79.72 CNAME time.microsoft.akadns.net
clients2.google.com	A 172.217.160.78 CNAME clients.l.google.com	142.250.66.110
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	51963	114.114.114.114	53
192.168.56.101	53210	114.114.114.114	53
192.168.56.101	53657	114.114.114.114	53
192.168.56.101	55368	114.114.114.114	53
192.168.56.101	60215	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	123	20.189.79.72 time.windows.com	123
192.168.56.101	50002	224.0.0.252	5355
192.168.56.101	50534	224.0.0.252	5355
192.168.56.101	51808	224.0.0.252	5355
192.168.56.101	53380	224.0.0.252	5355
192.168.56.101	56539	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	57756	224.0.0.252	5355
192.168.56.101	57874	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	60384	224.0.0.252	5355
192.168.56.101	61680	224.0.0.252	5355

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.