SmartHawk

1.0

低危

该样本未表现出任何异常！

927760174fcc7acfa901c4b0a048eafb61bb2ca31d6a8acdd67b513c8a19f9fd

ac3aac8b7a7cd9e1b6f738df3aff5a86.exe

分析耗时

21s

最近分析

文件大小

271.8KB

静态报毒动态报毒

未检测暂无鹰眼引擎检测结果

未检测暂无反病毒引擎检测结果

This executable has a PDB path (1 个事件)

pdb_path

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 个事件)

section

.gfids

Communicates with host for which no DNS query was performed (1 个事件)

host

172.217.24.14

暂无二进制图像该样本未生成二进制可视化图像

暂无运行截图该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析

⚡ 行为特征

🛡️ 防护建议

🔧 技术手段

🎯 检测方法

🤖

Static Analysis
Strings

PE Compile Time

2016-08-15 03:15:49

Imports

Library KERNEL32.dll:

• 0x42f000 GetLastError

• 0x42f004 SetLastError

• 0x42f008 GetCurrentProcess

• 0x42f00c DeviceIoControl

• 0x42f010 SetFileTime

• 0x42f014 CloseHandle

• 0x42f018 CreateDirectoryW

• 0x42f01c RemoveDirectoryW

• 0x42f020 CreateFileW

• 0x42f024 DeleteFileW

• 0x42f028 CreateHardLinkW

• 0x42f02c GetShortPathNameW

• 0x42f030 GetLongPathNameW

• 0x42f034 MoveFileW

• 0x42f038 GetFileType

• 0x42f03c GetStdHandle

• 0x42f040 WriteFile

• 0x42f044 ReadFile

• 0x42f048 FlushFileBuffers

• 0x42f04c SetEndOfFile

• 0x42f050 SetFilePointer

• 0x42f054 SetFileAttributesW

• 0x42f058 GetFileAttributesW

• 0x42f05c FindClose

• 0x42f060 FindFirstFileW

• 0x42f064 FindNextFileW

• 0x42f068 GetVersionExW

• 0x42f06c GetCurrentDirectoryW

• 0x42f070 GetFullPathNameW

• 0x42f074 FoldStringW

• 0x42f078 GetModuleFileNameW

• 0x42f07c GetModuleHandleW

• 0x42f080 FindResourceW

• 0x42f084 FreeLibrary

• 0x42f088 GetProcAddress

• 0x42f08c GetCurrentProcessId

• 0x42f090 ExitProcess

• 0x42f094 SetThreadExecutionState

• 0x42f098 Sleep

• 0x42f09c LoadLibraryW

• 0x42f0a0 GetSystemDirectoryW

• 0x42f0a4 CompareStringW

• 0x42f0a8 AllocConsole

• 0x42f0ac FreeConsole

• 0x42f0b0 AttachConsole

• 0x42f0b4 WriteConsoleW

• 0x42f0b8 GetProcessAffinityMask

• 0x42f0bc CreateThread

• 0x42f0c0 SetThreadPriority

• 0x42f0c4 InitializeCriticalSection

• 0x42f0c8 EnterCriticalSection

• 0x42f0cc LeaveCriticalSection

• 0x42f0d0 DeleteCriticalSection

• 0x42f0d4 SetEvent

• 0x42f0d8 ResetEvent

• 0x42f0dc ReleaseSemaphore

• 0x42f0e0 WaitForSingleObject

• 0x42f0e4 CreateEventW

• 0x42f0e8 CreateSemaphoreW

• 0x42f0ec GetSystemTime

• 0x42f0f0 SystemTimeToTzSpecificLocalTime

• 0x42f0f4 TzSpecificLocalTimeToSystemTime

• 0x42f0f8 SystemTimeToFileTime

• 0x42f0fc FileTimeToLocalFileTime

• 0x42f100 LocalFileTimeToFileTime

• 0x42f104 FileTimeToSystemTime

• 0x42f108 GetCPInfo

• 0x42f10c IsDBCSLeadByte

• 0x42f110 MultiByteToWideChar

• 0x42f114 WideCharToMultiByte

• 0x42f118 GlobalAlloc

• 0x42f11c GetTickCount

• 0x42f120 SetCurrentDirectoryW

• 0x42f124 GetExitCodeProcess

• 0x42f128 GetLocalTime

• 0x42f12c MapViewOfFile

• 0x42f130 UnmapViewOfFile

• 0x42f134 CreateFileMappingW

• 0x42f138 OpenFileMappingW

• 0x42f13c GetCommandLineW

• 0x42f140 SetEnvironmentVariableW

• 0x42f144 ExpandEnvironmentStringsW

• 0x42f148 GetTempPathW

• 0x42f14c MoveFileExW

• 0x42f150 GetLocaleInfoW

• 0x42f154 GetTimeFormatW

• 0x42f158 GetDateFormatW

• 0x42f15c GetNumberFormatW

• 0x42f160 RaiseException

• 0x42f164 GetSystemInfo

• 0x42f168 VirtualProtect

• 0x42f16c VirtualQuery

• 0x42f170 LoadLibraryExA

• 0x42f174 IsProcessorFeaturePresent

• 0x42f178 IsDebuggerPresent

• 0x42f17c UnhandledExceptionFilter

• 0x42f180 SetUnhandledExceptionFilter

• 0x42f184 GetStartupInfoW

• 0x42f188 QueryPerformanceCounter

• 0x42f18c GetCurrentThreadId

• 0x42f190 GetSystemTimeAsFileTime

• 0x42f194 InitializeSListHead

• 0x42f198 TerminateProcess

• 0x42f19c RtlUnwind

• 0x42f1a0 EncodePointer

• 0x42f1a4 InitializeCriticalSectionAndSpinCount

• 0x42f1a8 TlsAlloc

• 0x42f1ac TlsGetValue

• 0x42f1b0 TlsSetValue

• 0x42f1b4 TlsFree

• 0x42f1b8 LoadLibraryExW

• 0x42f1bc QueryPerformanceFrequency

• 0x42f1c0 GetModuleHandleExW

• 0x42f1c4 GetModuleFileNameA

• 0x42f1c8 GetACP

• 0x42f1cc HeapFree

• 0x42f1d0 HeapAlloc

• 0x42f1d4 HeapReAlloc

• 0x42f1d8 GetStringTypeW

• 0x42f1dc LCMapStringW

• 0x42f1e0 FindFirstFileExA

• 0x42f1e4 FindNextFileA

• 0x42f1e8 IsValidCodePage

• 0x42f1ec GetOEMCP

• 0x42f1f0 GetCommandLineA

• 0x42f1f4 GetEnvironmentStringsW

• 0x42f1f8 FreeEnvironmentStringsW

• 0x42f1fc GetProcessHeap

• 0x42f200 SetStdHandle

• 0x42f204 HeapSize

• 0x42f208 GetConsoleCP

• 0x42f20c GetConsoleMode

• 0x42f210 SetFilePointerEx

• 0x42f214 DecodePointer

Hosts

No hosts contacted.

DNS

Name	Response	Post-Analysis Lookup
dns.msftncsi.com	A 131.107.255.255	131.107.255.255
dns.msftncsi.com	AAAA fd3e:4f5a:5b81::1	131.107.255.255
teredo.ipv6.microsoft.com

TCP

No TCP connections recorded.

UDP

Source	Source Port	Destination	Destination Port
192.168.56.101	49235	114.114.114.114	53
192.168.56.101	50534	114.114.114.114	53
192.168.56.101	56539	114.114.114.114	53
192.168.56.101	65004	114.114.114.114	53
192.168.56.101	137	192.168.56.255	137
192.168.56.101	138	192.168.56.255	138
192.168.56.101	55368	224.0.0.252	5355
192.168.56.101	56804	224.0.0.252	5355
192.168.56.101	60123	224.0.0.252	5355
192.168.56.101	62191	224.0.0.252	5355
192.168.56.101	1900	239.255.255.250	1900
192.168.56.101	50535	239.255.255.250	3702
192.168.56.101	56540	239.255.255.250	3702
192.168.56.101	56807	239.255.255.250	1900
192.168.56.101	58707	239.255.255.250	3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.

Sorry! No dropped buffers.