3.6
中危
该样本未表现出任何异常！
重新分析
更多

cb587d7d3f9e2eddc96420d80ba48aba932cf93edf9e7ec590a24614e33325b7

ad13fff6ff70499cfa02b486b6661863.exe

分析耗时

81s

最近分析

文件大小

2.4MB
静态报毒 动态报毒
鹰眼引擎
未检测 暂无鹰眼引擎检测结果
静态判定
反病毒引擎
未检测 暂无反病毒引擎检测结果
静态指标
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 个事件)
Time & API Arguments Status Return Repeated
1621015025.308875
GlobalMemoryStatusEx
success 1 0
The executable uses a known packer (1 个事件)
packer Armadillo v1.71
行为判定
动态指标
Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 个事件)
Time & API Arguments Status Return Repeated
1620985519.563879
GetDiskFreeSpaceW
root_path: C:\
sectors_per_cluster: 8
number_of_free_clusters: 4787054
total_number_of_clusters: 8362495
bytes_per_sector: 512
success 1 0
Creates executable files on the filesystem (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe
Drops a binary and executes it (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe
Drops an executable to the user AppData folder (1 个事件)
file C:\Users\Administrator.Oskar-PC\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe
可视化分析
二进制图像
暂无二进制图像 该样本未生成二进制可视化图像
运行截图
暂无运行截图 该样本运行过程中未生成截图

👋 欢迎使用 ChatHawk

我是您的恶意软件分析助手，可以帮您分析和解读恶意软件报告。请随时向我提问！

🔍 主要威胁分析
⚡ 行为特征
🛡️ 防护建议
🔧 技术手段
🎯 检测方法
🤖

PE Compile Time

2004-10-13 23:10:17

Imports

Library KERNEL32.dll:
• 0x406000 lstrcmpiA
• 0x406004 lstrcpyA
• 0x406008 lstrlenA
• 0x40600c _lclose
• 0x406010 RemoveDirectoryA
• 0x406014 DeleteFileA
• 0x406018 GetModuleFileNameA
• 0x40601c _lread
• 0x406020 _llseek
• 0x406024 _lopen
• 0x406028 GetDiskFreeSpaceA
• 0x406030 CreateDirectoryA
• 0x406034 GetFileAttributesA
• 0x406038 lstrcatA
• 0x40603c GetTempPathA
• 0x406044 _lwrite
• 0x406048 _lcreat
• 0x40604c CloseHandle
• 0x406050 GetExitCodeProcess
• 0x406054 CreateProcessA
• 0x406058 ExitProcess
• 0x40605c TerminateProcess
• 0x406060 GetCurrentProcess
• 0x406064 HeapFree
• 0x406068 HeapAlloc
• 0x40606c GetModuleHandleA
• 0x406070 GetStartupInfoA
• 0x406074 GetCommandLineA
• 0x406078 GetVersion
• 0x40608c GetVersionExA
• 0x406090 HeapDestroy
• 0x406094 HeapCreate
• 0x406098 VirtualFree
• 0x40609c VirtualAlloc
• 0x4060a0 HeapReAlloc
• 0x4060a4 RtlUnwind
• 0x4060b4 WideCharToMultiByte
• 0x4060c0 SetHandleCount
• 0x4060c4 GetStdHandle
• 0x4060c8 GetFileType
• 0x4060cc GetCurrentThreadId
• 0x4060d0 TlsSetValue
• 0x4060d4 TlsAlloc
• 0x4060d8 SetLastError
• 0x4060dc TlsGetValue
• 0x4060e0 GetLastError
• 0x4060e4 WriteFile
• 0x4060e8 GetCPInfo
• 0x4060ec GetACP
• 0x4060f0 GetOEMCP
• 0x4060f4 GetProcAddress
• 0x4060f8 LoadLibraryA
• 0x406104 MultiByteToWideChar
• 0x406108 LCMapStringA
• 0x40610c LCMapStringW
• 0x406110 GetStringTypeA
• 0x406114 GetStringTypeW
Library USER32.dll:
• 0x40611c TranslateMessage
• 0x406120 DispatchMessageA
• 0x406124 PeekMessageA
• 0x40612c wsprintfA
• 0x406130 LoadCursorA
• 0x406134 SetCursor
• 0x406138 MessageBoxA

Hosts

No hosts contacted.

TCP

Source Source Port Destination Destination Port
52.218.91.68 80 192.168.56.101 49186

UDP

Source Source Port Destination Destination Port
192.168.56.101 50534 114.114.114.114 53
192.168.56.101 51808 114.114.114.114 53
192.168.56.101 58367 114.114.114.114 53
192.168.56.101 60123 114.114.114.114 53
192.168.56.101 137 192.168.56.255 137
192.168.56.101 138 192.168.56.255 138
192.168.56.101 55368 224.0.0.252 5355
192.168.56.101 56804 224.0.0.252 5355
192.168.56.101 62191 224.0.0.252 5355
192.168.56.101 63429 224.0.0.252 5355
192.168.56.101 65004 224.0.0.252 5355
192.168.56.101 1900 239.255.255.250 1900
192.168.56.101 51809 239.255.255.250 3702
192.168.56.101 51811 239.255.255.250 3702
192.168.56.101 58707 239.255.255.250 3702
192.168.56.101 62194 239.255.255.250 1900
192.168.56.101 63430 239.255.255.250 3702

HTTP & HTTPS Requests

No HTTP requests performed.

ICMP traffic

No ICMP traffic performed.

IRC traffic

No IRC requests performed.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Snort Alerts

No Snort Alerts

Sorry! No dropped files.
Sorry! No dropped buffers.